CVE-2026-33426

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users with tag-editing permissions could edit and create synonyms for tags hidden in restricted tag groups, even if they lacked visibility into those tags. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

• CWE-862

• https://github.com/discourse/discourse/security/advisories/GHSA-2289-4m46-2hxhVendor Advisory

Published

Mar 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33420Vaultwarden is a Bitwarden-compatible server written in Rust…5.3
• CVE-2026-33421Parse Server is an open source backend that can be deployed …6.5
• CVE-2026-33422Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33423Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33424Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33425Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2026-33427Discourse is an open-source discussion platform. Prior to ve…7.5
• CVE-2026-33428Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2026-33429Parse Server is an open source backend that can be deployed …5.3
• CVE-2026-3343A reflected cross-site scripting (XSS) vulnerability in the …6.1
• CVE-2026-33430Briefcase is a tool for converting a Python project into a s…7.3
• CVE-2026-33431Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…6.5