CVE-2026-33425 Overview
CVE-2026-33425 affects Discourse, an open-source discussion platform widely deployed for community forums. The vulnerability allows unauthenticated attackers to determine whether a specific user belongs to a private group. Attackers exploit the exclude_groups parameter in the user directory and observe differential changes in results. This is a side-channel information disclosure issue tracked under [CWE-203] (Observable Discrepancy). Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 are affected. The vendor released patches in those versions.
Critical Impact
Unauthenticated attackers can enumerate private group membership for any known user, exposing sensitive organizational relationships and access patterns.
Affected Products
- Discourse versions prior to 2026.1.2
- Discourse versions prior to 2026.2.1
- Discourse versions prior to 2026.3.0-latest.1
Discovery Timeline
- 2026-03-21 - CVE-2026-33425 published to NVD
- 2026-03-24 - Last updated in NVD database
Technical Details for CVE-2026-33425
Vulnerability Analysis
The flaw resides in Discourse's public user directory endpoint, which accepts the exclude_groups query parameter. Group membership in Discourse is often sensitive because private groups gate access to restricted categories, staff channels, and internal discussions. The directory response set changes measurably depending on whether a target user is a member of the excluded group. An attacker compares two directory queries — one with and one without exclude_groups set to the target group — and infers membership from the diff.
The issue is classified as an observable discrepancy ([CWE-203]). No authentication is required because the user directory is publicly accessible by default. The attack scales easily: an attacker can script enumeration across many users and many private groups.
Root Cause
The exclude_groups filter applies to the directory result set before the access control check considers whether the requester should learn about group membership. The filtering behavior itself becomes the oracle. Discourse did not normalize directory output to prevent membership inference through query-parameter-driven differences.
Attack Vector
Exploitation requires only network access to the Discourse instance and a publicly reachable user directory. An attacker issues two HTTP GET requests to the directory endpoint — one with the exclude_groups parameter targeting the private group of interest, one without — and compares whether the target username appears in both results. If the user disappears when the group is excluded, the attacker confirms membership. The attacker needs no account and leaves only standard web traffic in logs.
Detection Methods for CVE-2026-33425
Indicators of Compromise
- Repeated unauthenticated GET requests to the user directory endpoint containing the exclude_groups parameter from a single client.
- Paired directory requests targeting the same usernames with and without exclude_groups set, separated by short intervals.
- Directory enumeration patterns cycling through known private group identifiers.
Detection Strategies
- Inspect web server and reverse proxy logs for high-volume directory queries that include exclude_groups, particularly from unauthenticated sessions.
- Correlate request bursts against a list of internal private group names to identify targeted reconnaissance.
- Alert on anonymous clients issuing more directory requests per minute than a legitimate browsing baseline supports.
Monitoring Recommendations
- Forward Discourse application and NGINX access logs to a centralized analytics platform for retention and querying.
- Track per-IP and per-user-agent request rates against the /directory_items endpoint.
- Review admin audit logs for unexpected changes to user directory visibility settings.
How to Mitigate CVE-2026-33425
Immediate Actions Required
- Upgrade Discourse to 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 depending on your release track.
- If immediate patching is not possible, hide user profiles from public via Admin → Settings → hide user profiles from public.
- Audit private group membership for sensitive groups and rotate access where exposure is a concern.
Patch Information
Discourse released fixes in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. Review the Discourse GitHub Security Advisory GHSA-r6rh-xvf5-r5f2 for upgrade guidance and commit references.
Workarounds
- Disable public access to the user directory through the Discourse admin settings panel.
- Enable the hide user profiles from public setting to require authentication for directory access.
- Restrict access to the Discourse instance behind authenticated reverse proxy controls where feasible.
# Configuration example: enforce authenticated directory access in Discourse admin
# Admin → Settings → search: hide user profiles from public → enable
# Admin → Settings → search: allow anonymous access to user directory → disable
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
