Discourse Vulnerability Allows Network Probing via Email Settings

CVE Notify is flagging a security flaw in the popular open-source discussion platform, Discourse. The vulnerability, tracked as CVE-2026-33185, revolves around the group email settings test endpoint. According to CVE Notify, this endpoint could be exploited by non-staff group owners to force the Discourse server into initiating outbound connections to arbitrary hosts and ports. The potential here is significant: attackers could leverage this to probe internal network infrastructure, effectively mapping out targets behind firewalls.

The affected versions span several release lines, including specific ranges within 2026.1.0 through 2026.3.0. CVE Notify points out that the issue was present in versions 2026.1.0-latest up to but not including 2026.1.3, 2026.2.0-latest up to but not including 2026.2.2, and 2026.3.0-latest up to but not including 2026.3.0. Fortunately, patches are available. Discourse has addressed this by releasing updates 2026.1.3, 2026.2.2, and 2026.3.0, which rectify the vulnerability.