CVE-2026-33185 Overview
Discourse, the popular open-source discussion platform, contains a Server-Side Request Forgery (SSRF) vulnerability in the group email settings test endpoint. This flaw allows authenticated users with group owner privileges to force the server to initiate outbound connections to arbitrary hosts and ports. The vulnerability enables attackers to probe internal network infrastructure, potentially exposing sensitive services and network topology information that should not be accessible to external parties.
Critical Impact
Non-staff group owners can exploit this vulnerability to scan internal network resources, potentially discovering services, open ports, and infrastructure details that could facilitate further attacks on the organization.
Affected Products
- Discourse versions 2026.1.0-latest to before 2026.1.3
- Discourse versions 2026.2.0-latest to before 2026.2.2
- Discourse versions 2026.3.0-latest to before 2026.3.0
Discovery Timeline
- 2026-03-31 - CVE CVE-2026-33185 published to NVD
- 2026-04-01 - Last updated in NVD database
Technical Details for CVE-2026-33185
Vulnerability Analysis
This vulnerability is classified as CWE-918: Server-Side Request Forgery (SSRF). The flaw exists in the group email settings test endpoint within Discourse, which was inadvertently made accessible to non-staff group owners. When exploited, the server can be manipulated to make HTTP requests to arbitrary destinations specified by the attacker.
The primary security concern is that this endpoint lacks proper authorization controls and destination validation. While the endpoint was designed to test email server connectivity, insufficient restrictions allow attackers to specify arbitrary target hosts and ports. This effectively turns the Discourse server into a proxy for probing internal network infrastructure.
An attacker with group owner privileges can leverage this vulnerability to:
- Discover internal services running on the same network
- Enumerate open ports on internal systems
- Map network topology and identify potential targets for further attacks
- Potentially access cloud metadata endpoints (e.g., AWS instance metadata at 169.254.169.254)
- Bypass firewall restrictions by using the trusted Discourse server as an intermediary
Root Cause
The root cause of this vulnerability is improper access control on the group email settings test endpoint combined with insufficient validation of user-supplied destination parameters. The endpoint was accessible to non-staff group owners when it should have been restricted to administrators only. Additionally, the endpoint failed to validate that specified hosts and ports were within allowed ranges, enabling connections to arbitrary internal and external resources.
Attack Vector
The attack is network-based and requires low-complexity exploitation. An authenticated attacker with group owner privileges can send crafted requests to the email settings test endpoint, specifying internal IP addresses, hostnames, or cloud metadata URLs as the target destination. The Discourse server then initiates outbound connections on behalf of the attacker, revealing information about internal network services based on response times, error messages, and connection success/failure status.
The vulnerability mechanism involves manipulating the test email functionality to probe arbitrary network destinations. For technical implementation details, see the GitHub Security Advisory GHSA-5976-77mj-m4h3 and the remediation commit e75cf456.
Detection Methods for CVE-2026-33185
Indicators of Compromise
- Unusual outbound connection attempts from the Discourse server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
- Requests to the group email settings test endpoint with non-standard port numbers or internal hostnames
- Connection attempts to cloud metadata endpoints (169.254.169.254) from the web application
- Elevated frequency of email configuration test requests from non-administrative users
Detection Strategies
- Monitor web application logs for requests to group email settings endpoints from non-staff users
- Implement network-level monitoring for unexpected outbound connections originating from the Discourse server
- Configure web application firewall (WAF) rules to detect SSRF patterns targeting internal IP addresses
- Review audit logs for group owners repeatedly testing email configurations with unusual hostnames or ports
Monitoring Recommendations
- Enable detailed logging for all group configuration endpoints in Discourse
- Set up alerts for outbound connections from the Discourse server to internal network ranges
- Monitor for DNS lookups of internal hostnames initiated by the web application
- Implement egress filtering and log any blocked connection attempts from the Discourse server
How to Mitigate CVE-2026-33185
Immediate Actions Required
- Upgrade Discourse to patched versions: 2026.1.3, 2026.2.2, or 2026.3.0 immediately
- Audit group ownership assignments and review which users have group owner privileges
- Review logs for any suspicious email configuration test activity prior to patching
- Consider temporarily restricting group email settings functionality until the patch is applied
Patch Information
Discourse has released security patches addressing this vulnerability. Users should upgrade to the following fixed versions:
| Affected Version Range | Fixed Version |
|---|---|
| 2026.1.0-latest to 2026.1.2 | 2026.1.3 |
| 2026.2.0-latest to 2026.2.1 | 2026.2.2 |
| 2026.3.0-latest (pre-release) | 2026.3.0 |
The fix is documented in commit e75cf456. For complete details, refer to the GitHub Security Advisory.
Workarounds
- Restrict group owner privileges to trusted staff members only until the patch is applied
- Implement network-level egress filtering to prevent the Discourse server from connecting to internal IP ranges
- Use a Web Application Firewall (WAF) to block requests containing internal IP addresses or metadata URLs
- Deploy network segmentation to isolate the Discourse server from sensitive internal resources
# Example: Restrict outbound connections using iptables
# Block connections to internal networks from Discourse server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 169.254.169.254 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
