PT-2026-41764 · Discourse · Discourse

Davidtaylorhq · Published 2026-05-19 · Updated 2026-06-01 · CVE-2026-33514

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.4 Discourse versions prior to 2026.3.1 Discourse versions prior to 2026.4.1 Discourse versions prior to 2026.5.0-latest.1

Description An authenticated user on an instance with the form templates feature enabled can read the name and structured content of form templates intended for categories they are not authorized to access. This results in the disclosure of site configuration metadata.

Recommendations Update to version 2026.1.4 Update to version 2026.3.1 Update to version 2026.4.1 Update to version 2026.5.0-latest.1

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-DISCOURSE-2026-33514

CVE-2026-33514

GHSA-W6G7-P2P9-2M5H

Affected Products

Discourse

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33514.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-w6g7-p2p9-2m5h · Vendor Advisory
• https://github.com/discourse/discourse/commit/ae5c9570fb918442c4d96abc83c1e7e169909b02 · Patch
• https://osv.dev/vulnerability/BIT-discourse-2026-33514 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33514 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33514 · Security Note
• https://twitter.com/CVEnew/status/2056670108173627681 · Twitter Post
• https://t.me/cveNotify/165455 · Telegram Post
• https://t.me/cveNotify/163960 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2056566190525268156 · Twitter Post
• https://t.me/CVEtracker/54187 · Telegram Post