PT-2026-26703 · Discourse · Discourse

Jomaxr · Published 2026-03-20 · Updated 2026-03-27 · CVE-2026-33251

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open-source discussion platform. An authorization bypass issue in hidden Solved topics may allow unauthorized users to accept or unaccept solutions. The vulnerability relates to bypassing intended access restrictions.

Recommendations Update to Discourse version 2026.3.0-latest.1 or later. Update to Discourse version 2026.2.1 or later. Update to Discourse version 2026.1.2 or later. As a workaround, ensure only trusted users are part of the Site Setting for accept all solutions allowed groups.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-DISCOURSE-2026-33251

CVE-2026-33251

GHSA-VM2X-9H8X-7JXM

Affected Products

Discourse

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33251.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-vm2x-9h8x-7jxm · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2026-33251 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33251 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33251 · Security Note
• https://twitter.com/CVEnew/status/2035262123618533467 · Twitter Post