CVE-2026-33251

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass vulnerability in hidden Solved topics may allow unauthorized users to accept or unaccept solutions. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, ensure only trusted users are part of the Site Setting for accept_all_solutions_allowed_groups.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-332526.5The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated c CVE-2026-332538.4SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on t CVE-2026-332547.5An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a CVE-2026-332567.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The i CVE-2026-332577.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The i CVE-2026-332587.5By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.CVE-2026-332595.0Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally CVE-2026-33268.6The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX act CVE-2026-332607.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The i CVE-2026-332615.9A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.CVE-2026-332625.9An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of ser CVE-2026-332634.3When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor ha