CVE-2026-33415: Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated moderator-level user could retrieve post content, topic titles, and usernames from categories they were not authorized to view. Insufficient access controls on a sentiment analytics endpoint allowed category permission boundaries to be bypassed. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourse (discourse-ai)to a version that resolves this vulnerability.Fixed in 2026.1.3 - Upgrade
Upgrade
Discourse (discourse-ai)to a version that resolves this vulnerability.Fixed in 2026.2.2 - Upgrade
Upgrade
Discourse (discourse-ai)to a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33415?
CVE-2026-33415 is classified as a high-severity vulnerability due to the risk of unauthorized access to sensitive category content.
How do I fix CVE-2026-33415?
To fix CVE-2026-33415, update your Discourse installation to version 2026.1.3, 2026.2.2, or later versions of 2026.3.0.
Which versions of Discourse are affected by CVE-2026-33415?
CVE-2026-33415 affects Discourse versions 2026.1.0 to 2026.1.2, 2026.2.0 to 2026.2.1, and versions prior to 2026.3.0.
What impact does CVE-2026-33415 have on users?
CVE-2026-33415 can lead to unauthorized exposure of category content to users who should not have access.
Is there a workaround for CVE-2026-33415?
There are no known workarounds for CVE-2026-33415; the recommended action is to update to the fixed versions.