CVE-2025-68666: 
NixOS vulnerability analysis and mitigation

CVE-2025-68666 is an incorrect authorization vulnerability in Discourse, an open-source discussion platform, that allows users with moderation privileges to view user archives they should not have access to. Private topic and post content created by users is leaked through these archives, resulting in a breach of confidentiality. The vulnerability affects Discourse versions prior to 3.5.4 (stable), 2025.11.2, 2025.12.1, and 2026.1.0. It was published on January 28, 2026, with a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 5.9 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-863 (Incorrect Authorization) — the application fails to properly enforce access controls on user archive endpoints, allowing moderators to access archives that should be restricted to site administrators or the users themselves. An authenticated user with moderation-level privileges can access another user's archive via the network without any additional user interaction required. No public proof-of-concept exploit code or detailed technical write-up has been identified beyond the vendor advisory (GitHub Advisory).

Successful exploitation results in unauthorized disclosure of private topic and post content from user archives, constituting a high confidentiality impact with no integrity or availability impact. Any moderator on an affected Discourse instance could access private communications of any user, potentially exposing sensitive personal or organizational information. There is no evidence of lateral movement capability or system-level compromise associated with this vulnerability (GitHub Advisory, Red Hat CVE).

No public exploit code, active in-the-wild exploitation, or threat actor attribution has been reported for CVE-2025-68666. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with moderation privileges, which limits the attacker pool to trusted insiders or compromised moderator accounts (GitHub Advisory).

1. Obtain Moderator Access: Authenticate to the target Discourse instance using an account that has been granted moderation privileges (either legitimately or through account compromise).
2. Navigate to User Archives: Access the user archive endpoint for a target user — moderators can browse or request archives that should be restricted to admins or the account owner.
3. Retrieve Private Content: Download or view the archive, which contains private topic and post content authored by the targeted user, including content from private messages or restricted categories.
4. Exfiltrate Data: Extract sensitive information from the archive for further use, such as personal data, confidential discussions, or organizational information (GitHub Advisory).

• Logs: Discourse application logs showing moderator-level accounts accessing /u/<username>/archive or similar archive download endpoints for users other than themselves; unusual frequency of archive access requests from a single moderator account.
• Network: HTTP GET or POST requests to user archive endpoints originating from moderator sessions at unusual times or in bulk.
• Behavioral: A moderator account accessing archives of multiple users in a short time window, particularly outside normal administrative activity patterns (GitHub Advisory).

Discourse has released patched versions: 3.5.4 (stable), 2025.11.2, 2025.12.1, and 2026.1.0 — upgrading to one of these versions is the recommended remediation. As an immediate workaround prior to upgrading, site administrators can temporarily revoke the moderation role from all moderators to prevent unauthorized archive access. Administrators should audit moderator activity logs for any suspicious archive access that may have occurred before patching (GitHub Advisory).