Improper access control in Discourse - CVE-2026-33291
Published: July 1, 2026
Vulnerability identifier: #VU136164
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-33291
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Civilized Discourse Construction Kit, Inc.
Affected software:
Discourse
Discourse
Detailed vulnerability description
The vulnerability allows a remote user to create Zendesk tickets for topics they do not have access to view.
The vulnerability exists due to improper access control in the Zendesk ticket creation functionality when handling ticket creation for topics. A remote user can create a Zendesk ticket for a topic they cannot view to create Zendesk tickets for topics they do not have access to view.
Only forums that use the Zendesk plugin are vulnerable.
How to mitigate CVE-2026-33291
Install security update from vendor's website.