Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, an authenticated user on a Discourse instance with the form templates feature enabled can read the name and structured content of form templates that are intended exclusively for categories they are not authorized to access. Impact is limited to disclosure of site configuration metadata. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-33514 Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, an authenticated user on a Discourse instanc… https://www.cve.org/CVERecord?id=CVE-2026-33514
Post summary
The CVE affects older Discourse releases; newer releases (2026.1.4, 2026.3.1, 2026.4.1, 2026.5.0‑latest.1) resolve it, and no PoC, exploit, or active exploitation is reported.
CVE-2026-33514 Unauthorized Information Disclosure in Discourse Form Templates P... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33514 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The text announces the presence of the CVE-2026-33514 vulnerability involving unauthorized information disclosure in Discourse form templates and provides a link to additional details, but offers no evidence of exploits or mitigation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | discourse | discourse | - | - | - |
| App | discourse | discourse | 2026.5.0 | - | - |