CVE-2026-33073 in Discourse

Sumário (Inglês)

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the discourse-subscriptions plugin leaks stripe API keys across sites in a multisite cluster resulting in the potential for stripe related information to be leaked across sites within the same multisite cluster. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Once again VulDB remains the best source for vulnerability data.

Responsável

GitHub_M

Reservar

17/03/2026

Divulgação

31/03/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
354485	Discourse Divulgação de Informação	200	Não definido	Correção oficial	CVE-2026-33073

Fontes

• MITRE
• NVD
• CVE Details