CVE-2026-33393

Discourse fixes loose hostname matching in spam host allowlist

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `allowed_spam_host_domains` check used `String#end_with?` without domain boundary validation, allowing domains like `attacker-example.com` to bypass spam protection when `example.com` was allowlisted. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 require exact match or proper subdomain match (preceded by `.`) to prevent suffix-based bypass of `newuser_spam_host_threshold`. No known workarounds are available.

We have discovered 884 live websites that are affected by CVE-2026-33393.

Run a Free Instant Scan



Affected Software

Product  Discourse
Category Message Boards
Vulnerable Domains884 live websites (20% of Discourse install base)
Vulnerable Versions
  • from 2026.1 through 2026.1.2
  • from 2026.2 through 2026.2.1
Vulnerable Versions Count3 versions ( 4.23% of all versions)


Common Weakness Enumeration

CWE-284 Improper Access Control



Details

  • Published - Mar 19, 2026
  • Updated - Mar 20, 2026

Website Distribution by Country

Number of websites using CVE-2026-33393
United States481 websites


Germany193 websites
France39 websites
GB25 websites
Singapore18 websites
Switzerland14 websites
Netherlands14 websites
Russia11 websites
China10 websites
Canada9 websites

Website Distribution by TLD

Number of websites using CVE-2026-33393
.com389 websites
.org125 websites
.net44 websites
.io30 websites
.de29 websites
.fr15 websites
.co.uk13 websites
.ch11 websites
.eu10 websites
.nl9 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-33393

Top websites that are affected by CVE-2026-33393. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.org United States**,***
*********.***********.com United States**,***
***********.com United States***,***
*****.********.com Germany***,***
*********.*******.org Germany***,***
*********.de Germany***,***
****.***********.org United States***,***
*****.********.com Latvia***,***
*******.****.org Germany***,***
******.************.net United States***,***
See full domain list

FAQ

CVE-2026-33393 is Improper Access Control in Discourse
A total of 884 websites have been identified as vulnerable to CVE-2026-33393, based on global website indexing conducted by WebTechSurvey.
The Discourse is affected by the CVE-2026-33393 vulnerability.
Discourse versions up to 2026.2.1 are vulnerable to CVE-2026-33393.
CVE-2026-33393 is resolved in version 2026.2.1 of Discourse.