CVE-2026-33394

Discourse leaks PM post edits to moderators

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the Post Edits admin report (/admin/reports/post_edits) leaked the first 40 characters of raw post content from private messages and secure categories to moderators who shouldn't have access. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

We have discovered 884 live websites that are affected by CVE-2026-33394.

Run a Free Instant Scan



Affected Software

Product  Discourse
Category Message Boards
Vulnerable Domains884 live websites (20% of Discourse install base)
Vulnerable Versions
  • from 2026.1 through 2026.1.2
  • from 2026.2 through 2026.2.1
Vulnerable Versions Count3 versions ( 4.23% of all versions)


Common Weakness Enumeration

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor



Details

  • Published - Mar 19, 2026
  • Updated - Mar 20, 2026

Website Distribution by Country

Number of websites using CVE-2026-33394
United States481 websites


Germany193 websites
France39 websites
GB25 websites
Singapore18 websites
Switzerland14 websites
Netherlands14 websites
Russia11 websites
China10 websites
Canada9 websites

Website Distribution by TLD

Number of websites using CVE-2026-33394
.com389 websites
.org125 websites
.net44 websites
.io30 websites
.de29 websites
.fr15 websites
.co.uk13 websites
.ch11 websites
.eu10 websites
.nl9 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-33394

Top websites that are affected by CVE-2026-33394. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.org United States**,***
*********.***********.com United States**,***
***********.com United States***,***
*****.********.com Germany***,***
*********.*******.org Germany***,***
*********.de Germany***,***
****.***********.org United States***,***
*****.********.com Latvia***,***
*******.****.org Germany***,***
******.************.net United States***,***
See full domain list

FAQ

CVE-2026-33394 is Exposure of Sensitive Information to an Unauthorized Actor in Discourse
A total of 884 websites have been identified as vulnerable to CVE-2026-33394, based on global website indexing conducted by WebTechSurvey.
The Discourse is affected by the CVE-2026-33394 vulnerability.
Discourse versions up to 2026.2.1 are vulnerable to CVE-2026-33394.
CVE-2026-33394 is resolved in version 2026.2.1 of Discourse.