CVE-2026-33300

Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint

State: Published
Severity: 5.3 Medium
Published: Mar 31, 2026
Updated: Apr 1, 2026
Reserved: Mar 18, 2026

Description

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass in the Category Chatables Controller show action allowed moderators to get information on hidden groups names and user count. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
discoursediscourse	>= 2026.1.0-latest, < 2026.1.3Affected >= 2026.2.0-latest, < 2026.2.2Affected >= 2026.3.0-latest, < 2026.3.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.