CVE-2026-33300

MediumCVSS 6.5/10Last modified Jul 24, 2026

Description

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass in the Category Chatables Controller show action allowed moderators to get information on hidden groups names and user count. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-333018.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `CVE-2026-333028.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the module ACL fu CVE-2026-333035.4OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 are vulne CVE-2026-333046.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization CVE-2026-333055.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization CVE-2026-333067.5bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm. Prior to version 3.1.22, an integer overflow in the Java CVE-2026-333077.5Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. In versions prior to 0.12.3 and 0.13.0, code for client certificate verificatio CVE-2026-333085.9Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Prior to version 0.13.0, code for client certificate verification did not check CVE-2026-333099.9Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for C CVE-2026-33314.3The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0. Thi CVE-2026-333108.8Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter CVE-2026-333114.7DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4, 7.1.4, 8.0.3, and