Description
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, a user may be able to purchase a lower tier subscription but grant themselves the benefits that comes along with a higher tier subscription. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Published: 2026-03-31
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: Privilege Escalation via Unauthorized Subscription Elevation
Action: Immediate Patch
AI Analysis

Impact

A flaw in the discourse‑subscriptions plugin lets a user purchase a lower tier subscription yet assign themselves the benefits of a higher tier. The vulnerability falls under Improper Authorization (CWE‑269 and CWE‑285) and permits an attacker to gain additional features or access that the higher tier normally protects, potentially giving them unauthorized privilege or revenue‑based benefits.

Affected Systems

The vulnerability affects Discourse installations using the discourse‑subscriptions plugin. Version ranges impacted are 2026.1.0 up to, but not including, 2026.1.3; 2026.2.0 up to, but not including, 2026.2.2; and 2026.3.0 up to, but not including, 2026.3.0. The fix was released in 2026.1.3, 2026.2.2, and 2026.3.0.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. The attack is likely executable by any authenticated user who can interact with the subscription interface, as the vulnerability involves self‑assignment of higher tier privileges. Therefore the risk is real, albeit moderate, and worth addressing promptly.

Generated by OpenCVE AI on March 31, 2026 at 19:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Discourse to at least version 2026.1.3, 2026.2.2, or 2026.3.0, depending on the current release
  • Verify that the discourse‑subscriptions plugin is updated to a patched version
  • Review subscription assignment logic to ensure only authorized users can elevate tiers
  • Monitor user subscription activity for anomalous privilege changes

Generated by OpenCVE AI on March 31, 2026 at 19:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Apr 2026 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Discourse
Discourse discourse
Vendors & Products Discourse
Discourse discourse

Tue, 31 Mar 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 31 Mar 2026 18:00:00 +0000

Type Values Removed Values Added
Description Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, a user may be able to purchase a lower tier subscription but grant themselves the benefits that comes along with a higher tier subscription. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Title Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions
Weaknesses CWE-269
CWE-285
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Discourse Discourse
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-31T18:52:20.144Z

Reserved: 2026-03-17T19:27:06.344Z

Link: CVE-2026-33074

cve-icon Vulnrichment

Updated: 2026-03-31T18:50:10.530Z

cve-icon NVD

Status : Received

Published: 2026-03-31T18:16:51.963

Modified: 2026-03-31T18:16:51.963

Link: CVE-2026-33074

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-31T20:37:33Z

Weaknesses