CVE-2026-33427

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an unauthenticated attacker can cause a legitimate Discourse authorization page to display an attacker-controlled domain, facilitating social engineering attacks against users. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

• CWE-862

• https://github.com/discourse/discourse/security/advisories/GHSA-9vhg-2mx3-mqfrVendor Advisory

Published

Mar 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33421Parse Server is an open source backend that can be deployed …6.5
• CVE-2026-33422Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33423Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33424Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33425Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2026-33426Discourse is an open-source discussion platform. Prior to ve…3.8
• CVE-2026-33428Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2026-33429Parse Server is an open source backend that can be deployed …5.3
• CVE-2026-3343A reflected cross-site scripting (XSS) vulnerability in the …6.1
• CVE-2026-33430Briefcase is a tool for converting a Python project into a s…7.3
• CVE-2026-33431Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…6.5
• CVE-2026-33432Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…9.1