CVE-2026-33410 PUBLISHED

Discourse hardens chat DM channel creation and expansion

Assigner: GitHub_M
Reserved: 19.03.2026 Published: 19.03.2026 Updated: 19.03.2026

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have two authorization issues in the chat direct message API. First, when creating a direct message channel or adding users to an existing one, the target_groups parameter was passed directly to the user resolution query without checking group or member visibility for the acting user. An authenticated chat user could craft an API request with a known private/hidden group name and receive a channel containing that group's members, leaking their identities. Second, can_chat? only checked group membership, not the chat_enabled user preference. A chat-disabled user could create or query DM channels between other users via the direct messages API, potentially exposing private last_message content from the serialized channel response. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 5.4

Product Status

Vendor discourse
Product discourse
Versions
  • Version >= 2026.1.0-latest, < 2026.1.2 is affected
  • Version >= 2026.2.0-latest, < 2026.2.1 is affected
  • Version = 2026.3.0-latest is affected

References

Problem Types

  • CWE-863: Incorrect Authorization CWE