Discourse - Information Disclosure (CVE-2026-33425)
Description
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenticated users can determine whether a specific user is a member of a private group by observing changes in directory results when using the exclude_groups parameter. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, disable public access to the user directory via Admin → Settings → hide user profiles from public.
psychologyCrowdSec Analysis
CVE-2026-33425 is an information disclosure vulnerability in Discourse that allows unauthenticated attackers to infer whether a specific user belongs to a private group by comparing user directory results with the exclude_groups parameter. This can expose private group membership, and the issue is fixed in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2.
CrowdSec has been tracking this vulnerability and its exploits since 20th of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-33425 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target Discourse’s /directory_items.json endpoint and vary the exclude_groups parameter to compare directory results. Changes in the returned results can reveal whether users belong to private groups.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-03-20 |
| Rule Released | 2026-10-20 |
Related Weaknesses
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.