CVE-2026-33425

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open-source discussion platform. Unauthenticated users can determine whether a specific user is a member of a private group by observing changes in directory results when using the exclude groups parameter. This is possible through observing directory results.

Recommendations Update to version 2026.3.0-latest.1 or later. Update to version 2026.2.1 or later. Update to version 2026.1.2 or later. As a workaround, disable public access to the user directory via Admin → Settings → hide user profiles from public.