CVE-2025-68933: 
NixOS vulnerability analysis and mitigation

CVE-2025-68933 is a broken access control vulnerability (CWE-863: Incorrect Authorization) in Discourse, an open-source discussion platform. Non-admin moderators with the moderators_change_post_ownership setting enabled can transfer post ownership in private messages and restricted categories they are not authorized to access, then export their data to read the restricted content. The vulnerability was published on January 28, 2026, and affects Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. It carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, and 6.9 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is an incorrect authorization check (CWE-863) in Discourse's post ownership transfer feature. When the moderators_change_post_ownership site setting is enabled, the application fails to verify whether the moderator has visibility rights to the target topic or posts before executing the ownership transfer. This allows a non-admin moderator to invoke the ownership transfer API against posts in private messages or restricted categories they cannot normally access, reassign those posts to themselves, and subsequently use Discourse's data export functionality to retrieve and read the content. The patch resolves this by adding explicit visibility checks for both the topic and individual posts prior to permitting any ownership transfer (GitHub Advisory).

Successful exploitation allows a non-admin moderator to exfiltrate content from private messages and restricted categories they are not authorized to view, resulting in a confidentiality breach of sensitive user communications and restricted discussions. Integrity is also affected, as the ownership transfer itself modifies post metadata (authorship attribution) without authorization. There is no availability impact, and the scope is limited to the Discourse instance — lateral movement to other systems is not a direct consequence (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of publication. The EPSS score is approximately 0.019% (0.000190), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with non-admin moderator privileges and the moderators_change_post_ownership setting to be enabled on the target Discourse instance, limiting the attack surface (GitHub Advisory, Red Hat CVE).

1. Prerequisite: Obtain a non-admin moderator account on a Discourse instance where the moderators_change_post_ownership site setting is enabled.
2. Identify target content: Determine the existence of private messages or restricted category posts that the moderator account cannot normally access (e.g., through topic IDs visible in URLs or API responses).
3. Invoke ownership transfer: Use the Discourse post ownership transfer feature (or directly call the relevant API endpoint) to reassign ownership of posts in the inaccessible private message or restricted category to the attacker's own account, bypassing the missing visibility check.
4. Export data: Use Discourse's built-in data export functionality to download the account's post data, which now includes the transferred posts from the previously restricted content.
5. Read exfiltrated content: Open the exported data file to view the content of the private messages or restricted category posts that were transferred (GitHub Advisory).

• Logs: Discourse application logs showing post ownership transfer actions (change_post_ownership or equivalent API calls) initiated by a non-admin moderator account targeting topics or posts in private message threads or restricted categories.
• Logs: Data export requests (/admin/users/<id>/export_csv or similar endpoints) made by a moderator account shortly after ownership transfer events.
• Application Activity: Unusual post ownership change records in the Discourse admin panel (/admin/logs/staff_action_logs) where a moderator reassigns posts from users in private or restricted contexts to themselves.
• Database: Unexpected changes to post_revisions or topic_allowed_users tables reflecting ownership transfers to moderator accounts for topics they should not have access to.

Discourse has released patched versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, which add visibility checks for both the topic and posts before permitting any ownership transfer. Administrators should upgrade to one of these patched versions as the primary remediation. As an immediate workaround for sites that cannot upgrade promptly, disabling the moderators_change_post_ownership site setting will prevent non-admin moderators from using the post ownership transfer feature entirely (GitHub Advisory).