CVE-2026-33422: Discourse Information Disclosure Flaw

CVE-2026-33422 Overview

CVE-2026-33422 is an information disclosure vulnerability in Discourse, the popular open-source discussion platform. The flaw allows the ip_address of flagged users to be exposed to any user with access to the review queue, including users who should not have permission to view IP address information. This unauthorized exposure of sensitive user data could enable privacy violations and potential targeted attacks against users.

Critical Impact

Unauthorized disclosure of user IP addresses to lower-privileged moderators and users with review queue access, potentially enabling targeted harassment, doxing, or further reconnaissance attacks.

Affected Products

• Discourse versions prior to 2026.3.0-latest.1
• Discourse versions prior to 2026.2.1
• Discourse versions prior to 2026.1.2

Discovery Timeline

• 2026-03-20 - CVE-2026-33422 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33422

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw exists in Discourse's review queue functionality, where access control checks are insufficient to prevent unauthorized viewing of flagged users' IP addresses.

The review queue in Discourse is designed to allow moderators and trusted users to review flagged content and user reports. However, the implementation fails to properly enforce granular permission checks when rendering IP address information. Users with review queue access—who may not be granted full moderator privileges to view IP addresses—can see this sensitive data alongside flagged user reports.

This represents an access control bypass where the authorization logic does not distinguish between users who have legitimate review queue access and those with elevated permissions to view personally identifiable information (PII) such as IP addresses.

Root Cause

The root cause is an insufficient authorization check in the review queue rendering logic. When flagged user information is serialized for display in the review interface, the system includes the ip_address field without verifying whether the requesting user has explicit permission to view IP addresses. The permission model treats review queue access and IP address visibility as separate privileges, but the implementation incorrectly bundles them together when displaying flagged user data.

Attack Vector

An attacker with low-privileged access to the review queue can exploit this vulnerability through the following attack flow:

1. The attacker obtains a Discourse account with review queue access (e.g., TL4 trust level users or moderators without IP viewing permissions)
2. They navigate to the review queue interface where flagged users are displayed
3. The response payload from the server includes the ip_address field for flagged users
4. The attacker extracts IP addresses from flagged user reports without authorization

This is a network-accessible vulnerability requiring authenticated access with review queue privileges. No user interaction is required beyond accessing the review queue interface. The vulnerability can be exploited through normal platform navigation without special tools or techniques.

Detection Methods for CVE-2026-33422

Indicators of Compromise

• Unusual access patterns to review queue endpoints by users without IP viewing permissions
• API responses containing IP address data for users who should not have access to this information
• Elevated access frequency to moderation tools by specific accounts
• Log entries showing review queue access by users not in administrator or senior moderator groups

Detection Strategies

• Monitor access logs for the review queue endpoint and correlate with user permission levels
• Implement audit logging for any access to user IP address fields in the database
• Review user permission configurations to identify accounts with review queue access but without explicit IP viewing rights
• Deploy web application firewall rules to log suspicious patterns in review queue access

Monitoring Recommendations

• Enable detailed access logging for Discourse moderation endpoints
• Set up alerts for bulk access to the review queue by non-administrator accounts
• Regularly audit the list of users with review queue access permissions
• Monitor for data exfiltration patterns through API response analysis

How to Mitigate CVE-2026-33422

Immediate Actions Required

• Upgrade Discourse to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later immediately
• Audit which users currently have review queue access and verify their trust levels
• Review logs for any unauthorized access to flagged user IP addresses prior to patching
• Consider temporarily restricting review queue access to only administrators until patches are applied

Patch Information

Discourse has released patches in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 that address this vulnerability. The fix implements proper authorization checks to ensure that IP address information is only displayed to users with explicit permission to view such data.

For detailed patch information and advisory details, see the GitHub Security Advisory GHSA-x32r-45vg-vm84.

Workarounds

• No official workarounds are available according to the vendor advisory
• As a temporary measure, restrict review queue access to only trusted administrators until patches can be applied
• Consider using network-level restrictions to limit access to moderation endpoints
• Audit and reduce the number of users with review queue access to minimize exposure