PT-2026-26708 · Discourse · Discourse

Published

2026-03-20

·

Updated

2026-03-21

·

CVE-2026-33424

CVSS v3.1

5.9

Medium

AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an attacker can grant access to a private message topic through invites even after they lose access to that PM. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-33424

Affected Products

Discourse