CVE-2026-33393
Discourse is an open-source discussion platform.
Published Mar 19, 2026 · updated Jun 17, 2026 · discourse discourse
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the check used without domain boundary validation, allowing domains like to bypass spam protection when was allowlisted. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 require exact match or proper subdomain match (preceded by ) to prevent suffix-based bypass of . No known workarounds are available.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 19, 2026 · NIST NVD
Detected
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the check used without domain boundary validation, allowing domains like to bypass spam protection when was allowlisted. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 require exact match or proper subdomain match (preceded by ) to prevent suffix-based bypass of . No known workarounds
Jun 17, 2026 · NIST NVD
Updated
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the check used without domain boundary validation, allowing domains like to bypass spam protection when was allowlisted. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 require exact match or proper subdomain match (preceded by ) to prevent suffix-based bypass of . No known workarounds
Affected
- cpe discourse/discourseversion unspecified
- cpe discourse/discourse2026.3.0
Sources
- CVE.orgVulnerability recordCVE-2026-33393
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33393
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the check used without domain boundary validation, allowing domains like to bypass spam protection w
nvd.nist.gov