CVE-2026-33300

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33300
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33300.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33300
Aliases
Published
2026-03-31T17:42:00.882Z
Modified
2026-04-10T05:42:41.351545Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint
Details

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass in the Category Chatables Controller show action allowed moderators to get information on hidden groups names and user count. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33300.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Fixed
b3f024ce9587e678216892cbd967201b2450e197
Database specific 
{
    "versions": [
        {
            "introduced": "2026.1.0-latest"
        },
        {
            "fixed": "2026.1.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
f7cec86997edc21d6074ceb7666f7e2e6e1b1fdf
Fixed
4431801e7b5af883edb430643fdace7608ffb6fb
Database specific 
{
    "versions": [
        {
            "introduced": "2026.2.0-latest"
        },
        {
            "fixed": "2026.2.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
896e810e1b296478bba91559a8fc89a9926f11fe
Fixed
896e810e1b296478bba91559a8fc89a9926f11fe
Database specific 
{
    "versions": [
        {
            "introduced": "2026.3.0-latest"
        },
        {
            "fixed": "2026.3.0"
        }
    ]
}

Affected versions

Other
esr
stable
v2026.*
v2026.1.0
v2026.1.0-latest
v2026.1.1
v2026.1.2
v2026.2.0
v2026.2.0-latest
v2026.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33300.json"