Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-33074

Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions

Description

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, a user may be able to purchase a lower tier subscription but grant themselves the benefits that comes along with a higher tier subscription. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

discourse discourse

  • >= 2026.1.0-latest, < 2026.1.3affected
  • >= 2026.2.0-latest, < 2026.2.2affected
  • >= 2026.3.0-latest, < 2026.3.0affected

References