CVE-2026-33422

Published: Mar 20, 2026Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `ip_address` of a flagged user is exposed to any user who can access the review queue, including users who should not be able to see IP addresses. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

Affected (3)

Products: Discourse: Discourse

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Discourse Discourse	From 2026.1.0 to 2026.1.2
Discourse Discourse	From 2026.2.0 to 2026.2.1
Discourse Discourse	Version 2026.3.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (1)

https://github.com/discourse/discourse/security/advisories/GHSA-x32r-45vg-vm84

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.