CVE-2026-33073: Discourse Information Disclosure Flaw

CVE-2026-33073 Overview

CVE-2026-33073 is an information disclosure vulnerability affecting the Discourse open-source discussion platform. The discourse-subscriptions plugin improperly handles Stripe API keys in multisite cluster environments, potentially exposing payment-related credentials across different sites within the same cluster. This vulnerability allows Stripe API keys to leak between sites, which could enable unauthorized access to payment processing information and financial data.

Critical Impact

Stripe API key leakage across multisite cluster environments may expose sensitive payment processing credentials and financial information to unauthorized parties within the cluster.

Affected Products

• Discourse 2026.1.0-latest to before 2026.1.3
• Discourse 2026.2.0-latest to before 2026.2.2
• Discourse 2026.3.0-latest to before 2026.3.0

Discovery Timeline

• 2026-03-31 - CVE-2026-33073 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33073

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The discourse-subscriptions plugin, which integrates Stripe payment processing into Discourse forums, fails to properly isolate API credentials in multisite deployment configurations.

In a multisite cluster, multiple Discourse instances share underlying infrastructure while maintaining separate configurations. The vulnerability causes Stripe API keys configured for one site to become accessible to other sites within the same cluster. This design flaw in the plugin's credential management allows cross-site information leakage.

The attack requires network access and authenticated user privileges, along with user interaction, making exploitation somewhat complex but still viable in targeted scenarios.

Root Cause

The root cause of this vulnerability lies in improper isolation of site-specific configuration data within the discourse-subscriptions plugin. The plugin fails to correctly scope Stripe API credentials to individual sites in multisite deployments, instead allowing these sensitive keys to be accessible across the shared cluster infrastructure.

Attack Vector

The vulnerability is exploitable via network access by authenticated users within a multisite Discourse cluster. An attacker with legitimate access to one site in the cluster could potentially retrieve Stripe API keys belonging to other sites. This could enable:

• Unauthorized access to Stripe dashboard and payment information
• Potential manipulation of payment processing
• Exposure of customer payment data and transaction history
• Cross-site financial data leakage

The exploitation mechanism involves accessing the discourse-subscriptions plugin's configuration endpoints or internal data structures where Stripe credentials are improperly shared. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33073

Indicators of Compromise

• Unexpected API calls to Stripe from sites that should not have payment integration
• Access logs showing requests to discourse-subscriptions configuration endpoints from unauthorized sources
• Stripe dashboard activity from IP addresses not associated with the expected site
• Cross-site authentication patterns in multisite cluster logs

Detection Strategies

• Monitor Stripe API access logs for requests originating from unexpected Discourse instances
• Review multisite cluster logs for configuration data access patterns that cross site boundaries
• Implement alerting on Stripe API key usage anomalies across cluster sites
• Audit discourse-subscriptions plugin configuration access in server logs

Monitoring Recommendations

• Enable detailed logging for the discourse-subscriptions plugin across all multisite instances
• Configure Stripe webhook notifications to alert on unusual API activity
• Implement network segmentation monitoring between multisite cluster nodes
• Review Stripe API key usage patterns regularly for cross-site access anomalies

How to Mitigate CVE-2026-33073

Immediate Actions Required

• Upgrade Discourse to patched versions 2026.1.3, 2026.2.2, or 2026.3.0 immediately
• Rotate all Stripe API keys for affected sites after patching
• Audit Stripe transaction logs for any unauthorized access during the exposure window
• Review multisite cluster configurations for proper site isolation

Patch Information

Discourse has released security patches addressing this vulnerability. The fix is available in the following versions:

• Version 2026.1.3 for the 2026.1.x branch
• Version 2026.2.2 for the 2026.2.x branch
• Version 2026.3.0 for the 2026.3.x branch

The patch can be reviewed in the GitHub commit. Administrators should update their Discourse installations to these versions or later to remediate the vulnerability.

Workarounds

• Temporarily disable the discourse-subscriptions plugin until patching is complete
• Isolate multisite clusters by migrating sites with payment integration to dedicated instances
• Implement network-level restrictions to limit cross-site communication within clusters
• Consider temporarily revoking Stripe API keys and disabling payment functionality until the patch is applied

# Update Discourse to patched version
cd /var/discourse
./launcher rebuild app

# Verify installed version after update
./launcher enter app
rails runner "puts Discourse::VERSION::STRING"