CVE-2026-33073
discourse-subscriptions plugin leaking stripe API key in multisite environment
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
13th
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the discourse-subscriptions plugin leaks stripe API keys across sites in a multisite cluster resulting in the potential for stripe related information to be leaked across sites within the same multisite cluster. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
| CWE | CWE-200 |
| Vendor | discourse |
| Product | discourse |
| Published | Mar 31, 2026 |
| Last Updated | Apr 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for discourse discourse
Be the first to know when new medium vulnerabilities affecting discourse discourse are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
discourse / discourse
>= 2026.1.0-latest, < 2026.1.3 >= 2026.2.0-latest, < 2026.2.2 >= 2026.3.0-latest, < 2026.3.0