Discourse Auth Escalation via Sentiment API before 2026.2.2
CVE-2026-33415 Published on March 31, 2026
Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated moderator-level user could retrieve post content, topic titles, and usernames from categories they were not authorized to view. Insufficient access controls on a sentiment analytics endpoint allowed category permission boundaries to be bypassed. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-33415 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2026-33415
Want to know whenever a new CVE is published for Discourse? stack.watch will email you.
Affected Versions
discourse:- Version >= 2026.1.0-latest, < 2026.1.3 is affected.
- Version >= 2026.2.0-latest, < 2026.2.2 is affected.
- Version >= 2026.3.0-latest, < 2026.3.0 is affected.