CVE-2026-33355 PUBLISHED

Discourse filters whisper posts from private-posts feed

Assigner: GitHub_M
Reserved: 18.03.2026 Published: 19.03.2026 Updated: 19.03.2026

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the /private-posts endpoint did not apply post-type visibility filtering, allowing regular PM participants to see whisper posts in PM topics they had access to. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Product Status

Vendor discourse
Product discourse
Versions
  • Version >= 2026.1.0-latest, < 2026.1.2 is affected
  • Version >= 2026.2.0-latest, < 2026.2.1 is affected
  • Version = 2026.3.0-latest is affected

References

Problem Types

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE