PT-2026-29317 · Discourse · Discourse

Davidtaylorhq · Published 2026-03-31 · Updated 2026-04-07 · CVE-2026-33185

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.2.9

Description Discourse, an open-source discussion platform, had an issue where the group email settings test endpoint could be exploited to make the server initiate outbound connections to arbitrary hosts and ports. This could potentially allow probing of internal network infrastructure. The endpoint was accessible to non-staff group owners.

Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-DISCOURSE-2026-33185

CVE-2026-33185

GHSA-5976-77MJ-M4H3

Affected Products

Discourse

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33185.json · Exploit
• https://github.com/discourse/discourse/commit/e75cf456e8e318290c569bd6e8fa0f2586ffc530 · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-5976-77mj-m4h3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33185 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2026-33185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33185 · Security Note