CVE-2026-33251: Discourse Auth Bypass Vulnerability

CVE-2026-33251 Overview

CVE-2026-33251 is an authorization bypass vulnerability affecting Discourse, the popular open-source discussion platform. This security flaw exists in the handling of hidden Solved topics, where insufficient authorization checks may allow unauthorized users to accept or unaccept solutions on topics they should not have access to modify.

The vulnerability stems from improper access control (CWE-863) in the Solved plugin functionality. When topics are configured as hidden, the application fails to properly validate user permissions before allowing solution acceptance actions, potentially enabling privilege escalation within forum discussions.

Critical Impact

Unauthorized users can manipulate solution states on hidden topics, potentially disrupting forum workflows, elevating their visibility, or undermining trust in accepted answers.

Affected Products

• Discourse versions prior to 2026.3.0-latest.1
• Discourse versions prior to 2026.2.1
• Discourse versions prior to 2026.1.2

Discovery Timeline

• 2026-03-20 - CVE-2026-33251 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33251

Vulnerability Analysis

This authorization bypass vulnerability affects the Solved plugin functionality within Discourse. The core issue lies in how the platform handles permission checks when users attempt to accept or unaccept solutions on hidden topics. Hidden topics are designed to restrict visibility and interaction to specific user groups, but the vulnerability allows users outside these groups to modify the solution state.

The vulnerability can be exploited remotely over the network with low attack complexity, requiring only low-privilege authentication. Successful exploitation impacts both confidentiality and integrity, as attackers can view and modify solution states on topics that should be hidden from their access level.

Root Cause

The root cause is classified as CWE-863: Incorrect Authorization. The Discourse application fails to properly enforce authorization controls when processing requests to accept or unaccept solutions on hidden topics. The permission validation logic does not adequately verify whether the requesting user has the appropriate group membership or role to interact with hidden Solved topics.

Attack Vector

The attack vector is network-based, requiring an authenticated user with low privileges. An attacker can exploit this vulnerability by:

1. Authenticating to the Discourse instance with a standard user account
2. Identifying hidden topics that utilize the Solved plugin functionality
3. Submitting requests to accept or unaccept solutions on these hidden topics
4. Bypassing the intended authorization checks due to improper validation

The vulnerability does not require user interaction and can be exploited directly through API requests or the web interface. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33251

Indicators of Compromise

• Unexpected changes to solution acceptance states on hidden topics
• API requests to Solved plugin endpoints from users without appropriate group membership
• Audit log entries showing solution modifications by unauthorized accounts
• Anomalous patterns of solution accept/unaccept actions across multiple hidden topics

Detection Strategies

• Monitor Discourse audit logs for solution state changes on hidden topics by users not in authorized groups
• Implement alerting on API endpoints related to the Solved plugin (e.g., /t/:topic_id/solution) for unauthorized access attempts
• Review user activity logs for patterns indicating systematic exploration of hidden topic functionality
• Deploy web application firewall rules to detect and log suspicious requests targeting Solved plugin actions

Monitoring Recommendations

• Enable verbose logging for the Solved plugin and authorization subsystems
• Configure alerts for any solution state changes on topics with restricted visibility settings
• Regularly audit accept_all_solutions_allowed_groups site setting to ensure only trusted users are included
• Implement real-time monitoring of authorization failure events in application logs

How to Mitigate CVE-2026-33251

Immediate Actions Required

• Upgrade Discourse to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 immediately
• Review the accept_all_solutions_allowed_groups site setting and restrict membership to trusted users only
• Audit recent solution state changes on hidden topics for unauthorized modifications
• Consider temporarily disabling the Solved plugin on sensitive hidden categories until patching is complete

Patch Information

Discourse has released security patches addressing this vulnerability in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. Organizations should prioritize upgrading to one of these patched versions based on their current deployment track.

For complete patch details and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Review and restrict the accept_all_solutions_allowed_groups site setting to include only trusted users
• Remove untrusted users from groups that have permissions to interact with hidden topics
• Consider temporarily disabling the Solved plugin on categories containing sensitive hidden topics
• Implement additional access controls at the category level to limit exposure

# Configuration example - Restrict solution acceptance to trusted groups only
# In Discourse Admin Settings, navigate to:
# Admin > Settings > Plugins > solved

# Set accept_all_solutions_allowed_groups to trusted groups only
# Example: staff, moderators, trusted_users
# Remove any groups containing untrusted or general user populations