CVE-2024-24748: 
NixOS vulnerability analysis and mitigation

CVE-2024-24748 is a security vulnerability discovered in Discourse affecting versions stable <= 3.2.0, beta <= 3.3.0.beta1, and tests-passed <= 3.3.0.beta1. The vulnerability allows an attacker to discover the existence of secret subcategories under a public category which has no public subcategories (GitHub Advisory).

The vulnerability stems from improper access control in the category listing functionality. When querying categories, the system was incorrectly revealing information about the presence of subcategories even when those subcategories were meant to be secret. This was fixed by modifying how the has_children attribute is set in the CategoryList model (GitHub Commit).

The vulnerability allows unauthorized users to detect the presence of secret subcategories under public categories, potentially revealing sensitive organizational structure information. The CVSS v3.1 base score is 5.3 (Moderate), with metrics indicating Network attack vector, Low attack complexity, No privileges required, No user interaction needed, Unchanged scope, and Low confidentiality impact (GitHub Advisory).

The vulnerability can be exploited remotely without requiring any special privileges or user interaction. An attacker only needs access to the category listing functionality to potentially discover the existence of secret subcategories (GitHub Advisory).

The issue has been patched in Discourse versions stable >= 3.2.1, beta >= 3.3.0.beta2, and tests-passed >= 3.3.0.beta2. No workarounds are available, and users are advised to upgrade to the patched versions (GitHub Advisory).