CVE-2026-33514: Discourse: Information Disclosure in Form Template API Due to Missing Authorization
Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, an authenticated user on a Discourse instance with the form templates feature enabled can read the name and structured content of form templates that are intended exclusively for categories they are not authorized to access. Impact is limited to disclosure of site configuration metadata. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.4 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.4.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.5.0-latest.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33514?
CVE-2026-33514 has a severity rating of medium due to the potential for information disclosure.
How do I fix CVE-2026-33514?
To fix CVE-2026-33514, upgrade your Discourse instance to version 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1.
Who is affected by CVE-2026-33514?
Authenticated users on Discourse instances with the form templates feature enabled prior to the specified versions are affected by CVE-2026-33514.
What is the main issue caused by CVE-2026-33514?
CVE-2026-33514 allows authenticated users to read unauthorized information via the Form Template API.
When was CVE-2026-33514 reported?
CVE-2026-33514 was reported as part of the security advisories for Discourse prior to its resolution in the respective version updates.