Auth bypass in Discourse

CVE-2026-33428

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authoriza…

Vulnerability class: Broken Access Control

EPSS: 0.000 (6.0th percentile) — read the EPSS interpretation.