CVE-2026-33425
published 2026-03-21CVE-2026-33425: Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenticated users can determine whether a…
PriorityP341medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
0.77%
54.9th percentile
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenticated users can determine whether a specific user is a member of a private group by observing changes in directory results when using the `exclude_groups` parameter. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, disable public access to the user directory via Admin → Settings → hide user profiles from public.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| discourse | discourse | — | — |
| discourse | discourse | — | — |
| discourse | discourse | — | — |
| discourse | discourse | — | — |
| discourse | discourse | >= 2026.1.0 < 2026.1.2 | 2026.1.2 |
| discourse | discourse | >= 2026.2.0 < 2026.2.1 | 2026.2.1 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No advisories linked to this vulnerability.
No detection rules found.
Nuclei
Discourse - Private Group Membership Inference via exclude_groups
nuclei·CVSS 5.3
CVE-2026-33425 [MEDIUM] Discourse - Private Group Membership Inference via exclude_groups
Discourse - Private Group Membership Inference via exclude_groups
Discourse < 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contains an information disclosure caused by unauthenticated users observing directory results changes with the exclude_groups parameter, letting attackers determine private group membership, exploit requires public access to user directory.
Template:
id: CVE-2026-33425
info:
name: Discourse - Private Group Membership Inference via exclude_groups
author: str4k3r
severity: medium
description: |
Discourse < 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contains an information disclosure caused by unauthenticated users observing directory results changes with the exclude_groups parameter, letting attackers determine private group membership, exploit requires public access to
2026-03-21
Published