CVE-2026-33426 LOW

CVE-2026-33426: Discourse users can edit or synonymize hidden tags they can't see

Vendor Discourse
Product discourse
Weakness CWE-862 · Missing authorization
Published March 20, 2026
Last update March 24, 2026
View on NVD All CVEs

CVSS base score

3.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users with tag-editing permissions could edit and create synonyms for tags hidden in restricted tag groups, even if they lacked visibility into those tags. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

Key dates

02Disclosure timeline

March 20, 2026 CVE published
March 24, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-6214 Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook CVE-2025-66150 WordPress Appender plugin <= 1.1.1 - Broken Access Control vulnerability CVE-2025-31877 WordPress RestroPress plugin <= 3.2.8 - Broken Access Control vulnerability CVE-2025-23961 WordPress WordPress Graphs & Charts Plugin <= 2.0.8 - Broken Access Control vulnerability CVE-2026-40117 PraisonAIAgents Affected by Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate