CVE-2026-33422 — Discourse exposes ip_address of flagged user

CVE-2026-33422

Discourse exposes ip_address of flagged user PUBLISHED

Description (CNA)

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `ip_address` of a flagged user is exposed to any user who can access the review queue, including users who should not be able to see IP addresses. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

Affected (CNA)

Vendor / product	Versions
discourse / discourse	affected >= 2026.1.0-latest, < 2026.1.2; affected >= 2026.2.0-latest, < 2026.2.1; affected = 2026.3.0-latest

CWE

CWE-200

References

https://github.com/discourse/discourse/security/advisories/GHSA-x32r-45vg-vm84

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.