CVE-2026-33428: Discourse Auth Bypass Vulnerability

CVE-2026-33428 Overview

CVE-2026-33428 is an authorization bypass vulnerability affecting Discourse, a popular open-source discussion platform. The vulnerability allows non-staff users with elevated group membership to access deleted posts belonging to any user on the platform due to an overly broad authorization check on the deleted posts index endpoint. This represents a significant privacy breach as deleted content should only be accessible to staff members with appropriate permissions.

Critical Impact
Unauthorized access to deleted user posts enables potential exposure of sensitive information that users believed was permanently removed from the platform.

Affected Products

Discourse versions prior to 2026.3.0-latest.1
Discourse versions prior to 2026.2.1
Discourse versions prior to 2026.1.2

Discovery Timeline

2026-03-21 - CVE CVE-2026-33428 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33428

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), which occurs when a system fails to properly enforce access controls, allowing users to access resources beyond their intended privileges. In this case, the deleted posts index endpoint performs an inadequate authorization check that grants access based on elevated group membership rather than staff status.

The vulnerability specifically affects the endpoint responsible for listing deleted posts. While Discourse properly restricts most administrative functions to staff members, the authorization logic for this particular endpoint incorrectly treats certain elevated group memberships as equivalent to staff permissions. This creates a gap where regular users who belong to specific groups can enumerate and view deleted content from all users across the platform.

Root Cause

The root cause stems from an overly permissive authorization check in the deleted posts index controller. The authorization logic fails to properly distinguish between users with elevated group membership and actual staff members. Instead of requiring explicit staff role verification, the endpoint accepts a broader set of user privileges that includes non-staff elevated groups. This implementation flaw allows the authorization check to pass for users who should not have access to deleted content.

Attack Vector

The attack vector is network-based and requires low privileges to exploit. An attacker would need a valid user account with membership in an elevated group (but not necessarily staff status) on the target Discourse instance. Once authenticated, the attacker can access the deleted posts index endpoint to retrieve posts that have been deleted by any user on the platform.

The exploitation flow involves authenticating as a user with elevated group membership, then making requests to the deleted posts endpoint. Since the authorization check is overly broad, these requests succeed and return deleted post content that should only be visible to staff members.

Detection Methods for CVE-2026-33428

Indicators of Compromise

Unusual access patterns to the deleted posts index endpoint from non-staff user accounts
API requests to /admin/ or administrative endpoints from users without staff privileges
Elevated group members accessing administrative data endpoints outside their normal workflow
Unexpected retrieval of deleted content by users who are not moderators or administrators

Detection Strategies

Monitor application logs for access to the deleted posts index endpoint by non-staff users
Implement alerting on authorization anomalies where elevated group members access staff-restricted resources
Review user group assignments to identify accounts with elevated privileges that could exploit this vulnerability
Audit API access logs for patterns indicating systematic enumeration of deleted posts

Monitoring Recommendations

Enable detailed logging for all administrative endpoint access attempts
Set up alerts for access control failures or unexpected authorization grants on sensitive endpoints
Regularly audit user permissions and group memberships to ensure principle of least privilege
Monitor for bulk data access patterns that could indicate exploitation of this vulnerability

How to Mitigate CVE-2026-33428

Immediate Actions Required

Upgrade Discourse to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 immediately
Review access logs for any unauthorized access to deleted posts prior to patching
Audit users with elevated group memberships to assess potential exposure
Consider temporarily restricting elevated group permissions until the patch is applied

Patch Information

Discourse has released patches in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 that address this authorization bypass vulnerability. The fix properly restricts access to the deleted posts index endpoint to only staff members, regardless of other group memberships. Administrators should upgrade to one of these patched versions based on their current release track.

For detailed patch information, refer to the GitHub Security Advisory GHSA-frcw-p4mc-x6mp.

Workarounds

No known workarounds are available for this vulnerability
Upgrading to a patched version is the only effective mitigation
As a temporary measure, consider auditing and restricting elevated group memberships until patching is complete
Monitor access to administrative endpoints for suspicious activity while awaiting patch deployment

bash

# Upgrade Discourse to patched version
cd /var/discourse
./launcher rebuild app
# Verify version after rebuild
./launcher enter app
rails runner "puts Discourse::VERSION::STRING"