CVE-2026-33074: 
NixOS vulnerability analysis and mitigation

CVE-2026-33074 is a privilege escalation vulnerability in the discourse-subscriptions plugin for Discourse, an open-source discussion platform. It allows users to purchase a lower-tier subscription while granting themselves the benefits of a higher-tier subscription through improper authorization controls. Affected versions include 2026.1.0-latest through before 2026.1.3, 2026.2.0-latest through before 2026.2.2, and 2026.3.0-latest before 2026.3.0. It was published on March 31, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory).

The vulnerability is rooted in improper privilege management (CWE-269) and improper authorization (CWE-285) within the /s/finalize endpoint of the discourse-subscriptions plugin. During the Stripe 3D Secure authentication flow, the /s/finalize endpoint accepted client-supplied plan and transaction parameters to determine which subscription group a user would be added to after payment. An authenticated user could complete a cheap subscription via SubscribeController#create but then supply a premium plan ID when calling #finalize, granting themselves access to a higher-tier group without paying for it. The fix links the two endpoints server-side using a server session: #create stores the transaction ID and plan ID in the server session, and #finalize reads exclusively from the session rather than accepting client-controlled parameters (GitHub Advisory, GitHub Commit).

Successful exploitation allows a user to bypass subscription tier restrictions and access premium features and benefits intended only for higher-cost subscription tiers, resulting in a low integrity impact to the subscription system. There is no confidentiality or availability impact. The primary business consequence is financial loss through subscription tier evasion, as users can obtain premium platform capabilities without paying the corresponding price (GitHub Advisory).

No public proof-of-concept exploit is known, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.041%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated user account and the presence of specific attack conditions (the 3D Secure payment flow), which increases the practical complexity (GitHub Advisory).

1. Obtain a Discourse account: Register or log in to a Discourse instance running a vulnerable version of the discourse-subscriptions plugin (2026.1.0–2026.1.2, 2026.2.0–2026.2.1, or 2026.3.0-latest before the patch).
2. Initiate a low-tier subscription purchase: Begin the subscription process by selecting and paying for a lower-cost subscription plan via SubscribeController#create, triggering the Stripe 3D Secure authentication flow (resulting in an incomplete or open transaction status).
3. Intercept the finalize request: Using a proxy tool (e.g., Burp Suite), intercept the HTTP request sent to the /s/finalize endpoint after completing 3D Secure authentication.
4. Substitute a premium plan ID: Modify the client-supplied plan and/or transaction parameters in the intercepted request to reference a higher-tier subscription plan ID.
5. Submit the manipulated request: Forward the modified request to the server. Because the vulnerable endpoint trusts client-supplied parameters, the server adds the user to the premium subscription group without verifying the actual payment tier.
6. Access premium features: The user now has access to higher-tier subscription benefits without having paid for them (GitHub Advisory, GitHub Commit).

• Logs: Discourse application logs showing a user completing a low-cost subscription via SubscribeController#create followed immediately by a /s/finalize request referencing a different (higher-tier) plan ID than the one purchased.
• Database: Users assigned to premium subscription groups whose Stripe payment records reflect only a lower-tier plan purchase; mismatches between the plan stored in the subscription record and the group membership granted.
• Network: HTTP POST requests to the /s/finalize endpoint containing plan or transaction parameter values that do not correspond to the plan initiated in the preceding #create call.

Discourse has released patched versions: 2026.1.3, 2026.2.2, and 2026.3.0. Administrators should upgrade to the appropriate patched version for their release branch as the primary remediation. As a temporary workaround prior to upgrading, the discourse-subscriptions plugin can be disabled entirely. After patching, it is recommended to audit subscription group memberships and compare them against actual Stripe payment records to identify any users who may have exploited this vulnerability (GitHub Advisory).