CVE-2026-33073CWE-200

discourse-subscriptions plugin leaking stripe API key in multisite environment

Low · published March 31, 2026

CVSS v4.0
2.0
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the discourse-subscriptions plugin leaks stripe API keys across sites in a multisite cluster resulting in the potential for stripe related information to be leaked across sites within the same multisite cluster. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

The record
Technical detail
CVSS v4.0
2.0 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00292 · 20.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-03-31T17:38Z
EPSS history
Timeline
  • 31 MAR 17:38Z
    discourse-subscriptions plugin leaking stripe API key in multisite environment
    cvelistv5