Description
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `allowed_spam_host_domains` check used `String#end_with?` without domain boundary validation, allowing domains like `attacker-example.com` to bypass spam protection when `example.com` was allowlisted. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 require exact match or proper subdomain match (preceded by `.`) to prevent suffix-based bypass of `newuser_spam_host_threshold`. No known workarounds are available.
INFO
Published Date :
2026-03-19T22:04:26.484Z
Last Modified :
2026-03-20T20:15:16.294Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-33393 vulnerability.
| Vendors | Products |
|---|---|
| Discourse |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-33393.
