CVE-2026-33291: 
NixOS vulnerability analysis and mitigation

CVE-2026-33291 is an incorrect authorization vulnerability in Discourse, an open-source discussion platform, affecting its Zendesk plugin integration. The flaw allows moderators to create Zendesk tickets for topics they do not have permission to view, constituting an authorization bypass. It affects all Discourse forums using the Zendesk plugin in versions prior to 2026.1.2 (for the 2026.1.x branch), 2026.2.1 (for the 2026.2.x branch), and 2026.3.0-latest.1 (for the 2026.3.x branch). The vulnerability was published on March 20, 2026, with a patch released shortly after. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): the Zendesk plugin's ticket-creation functionality fails to verify whether the requesting moderator has read access to the target topic before allowing ticket creation. This means the authorization check governing topic visibility is not enforced at the Zendesk integration layer, creating a gap between Discourse's access control model and the plugin's actions. An attacker with moderator-level privileges can exploit this over the network with low complexity by simply initiating a Zendesk ticket creation request referencing a restricted topic ID. No special conditions or user interaction beyond moderator access are required (GitHub Advisory).

Successful exploitation allows moderators to access and disclose content from restricted or private topics they are not authorized to view, resulting in unauthorized information disclosure. Additionally, the creation of Zendesk tickets for these topics introduces data integrity concerns, as sensitive topic data may be exposed within the Zendesk ticketing system to parties outside the intended access scope. Availability is not impacted, and the vulnerability is scoped to the Discourse instance and its connected Zendesk environment (GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of publication. The EPSS score is approximately 0.038%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated moderator account, limiting the attack surface to trusted insiders or compromised moderator credentials (GitHub Advisory).

1. Obtain moderator access: Gain or already possess a moderator-level account on a Discourse forum that has the Zendesk plugin enabled.
2. Identify restricted topic IDs: Enumerate topic IDs for topics the moderator account cannot normally access (e.g., private category topics or staff-only discussions) through indirect means such as observing topic ID sequences or API enumeration.
3. Initiate Zendesk ticket creation: Use the Discourse Zendesk plugin's ticket-creation feature, supplying the restricted topic's ID in the request. The plugin does not validate whether the moderator has read access to the referenced topic.
4. Access disclosed content: The Zendesk ticket is created successfully and may include topic metadata or content, effectively bypassing Discourse's topic-level access controls and exposing restricted information within the Zendesk system (GitHub Advisory).

• Logs: Discourse application logs showing Zendesk ticket creation requests from moderator accounts referencing topic IDs in categories or access groups the moderator is not a member of.
• Logs: Zendesk audit logs showing ticket creation events linked to Discourse topics that are classified as private or restricted.
• Application Behavior: Zendesk tickets appearing for topics that should be inaccessible to the moderator who created them, detectable via cross-referencing Discourse topic permissions with Zendesk ticket metadata.

Discourse has released patched versions addressing this vulnerability: 2026.1.2 (for the 2026.1.x branch), 2026.2.1 (for the 2026.2.x branch), and 2026.3.0-latest.1 (for the 2026.3.x branch). No official workarounds are available from the vendor. As a temporary containment measure if immediate patching is not feasible, administrators may consider disabling the Zendesk plugin or restricting moderator roles to only fully trusted administrators until the patch can be applied (GitHub Advisory).