QwikSec

Security Database

CVE

CWE

Training

CVE-2026-33074

Published: Mar 31, 2026

Modified: Mar 31, 2026

PUBLISHED

Description

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, a user may be able to purchase a lower tier subscription but grant themselves the benefits that comes along with a higher tier subscription. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Vendor	Product	Versions
discourse	discourse	affected `>= 2026.1.0-latest, < 2026.1.3` affected `>= 2026.2.0-latest, < 2026.2.2` affected `>= 2026.3.0-latest, < 2026.3.0`

Weaknesses (CWE)

References

https://github.com/discourse/discourse/security/advisories/GHSA-9vg5-mp49-xghh

x_refsource_CONFIRM

https://github.com/discourse/discourse/commit/c34f2aac8dcd1ae2886fa84256f607bc003f9d80

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.