CVE-2026-33185: Discourse: Group SMTP test endpoint susceptible to SSRF
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the group email settings test endpoint could be used to make the server initiate outbound connections to arbitrary hosts and ports. This could allow probing of internal network infrastructure. The endpoint was accessible to non-staff group owners. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.2.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33185?
CVE-2026-33185 has been classified as a serious vulnerability due to its potential for SSRF attacks.
How do I fix CVE-2026-33185?
To fix CVE-2026-33185, update your Discourse installation to versions 2026.1.3, 2026.2.2, or later.
Which versions of Discourse are affected by CVE-2026-33185?
Discourse versions from 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0 to before 2026.3.0 are affected by CVE-2026-33185.
What type of attack does CVE-2026-33185 facilitate?
CVE-2026-33185 facilitates Server-Side Request Forgery (SSRF) attacks through the group email settings test endpoint.
Is there a specific endpoint vulnerable in CVE-2026-33185?
Yes, the group email settings test endpoint is specifically vulnerable in CVE-2026-33185.