Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Discourse lets moderators see hidden group names

CVE-2026-33300 · published 7 months ago
Summary

In certain recent Discourse releases, moderators could use a specific page to view the names and member counts of groups that were meant to stay hidden. This exposure could reveal internal team structures or private discussions. Updating Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0 (or later) resolves the issue.

What to do
  • Update discourse to version 2026.2.2.
Affected software
Ecosystem VendorProductAffected versions
Bitnami – discourse >= 2026.2.0, < 2026.2.2
Fix: upgrade to 2026.2.2
– discourse discourse >= 2026.1.0, < 2026.1.3
>= 2026.2.0, < 2026.2.2
2026.3.0
cpe:2.3:a:discourse:discourse:*:*:*:*:latest:*:*:*
Original advisory text
Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass in the Category Chatables Controller show action allowed moderators to get information on hidden groups names and user count. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published31 Mar 2026
Updated4 Nov 2026
First seen31 Mar 2026
Sources
CVE-2026-33300 · NVD
BIT-discourse-2026-33300 · OSV
GHSA-wrwm-vqx2-6x4v · GHSA
CVE-2026-33300 · OSV
Track software like this
Free during beta