CVE-2025-69218: 
NixOS vulnerability analysis and mitigation

CVE-2025-69218 is an incorrect authorization vulnerability in Discourse, the open-source discussion platform, that allows moderators to access the top_uploads admin report which should be restricted to administrators only. This report exposes direct URLs to all uploaded files on the site, including sensitive content such as user data exports, admin backups, and private attachments. The vulnerability affects Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. It was published on January 28, 2026, with a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-863 (Incorrect Authorization): the Discourse application performs an authorization check when a moderator attempts to access the top_uploads admin report endpoint, but the check does not correctly enforce the admin-only restriction. As a result, any authenticated moderator can access this report over the network without requiring elevated admin privileges or any special conditions beyond holding a moderator role. The report returns direct URLs to all uploaded files on the platform, bypassing the intended access control boundary between moderator and administrator roles (GitHub Advisory).

Successful exploitation allows a moderator-level user to obtain direct URLs to all files uploaded to the Discourse instance, including highly sensitive content such as user data exports, administrator backups, and private attachments that are intended to be accessible only to administrators. This is a confidentiality-only impact — there is no integrity or availability impact — but the exposed data could include personally identifiable information (PII), credentials, or configuration details contained in backups, potentially enabling further attacks or regulatory compliance violations (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-69218. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability requires an authenticated moderator account, which limits the attacker pool but does not require any special technical skill beyond knowing the admin report endpoint. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Obtain moderator access: Acquire or compromise a Discourse account with moderator-level privileges on the target instance (e.g., through social engineering, credential theft, or a free/trial moderator account).
2. Identify the target endpoint: Locate the top_uploads admin report endpoint on the Discourse instance (typically accessible via the Discourse admin API or admin panel report routes).
3. Send authenticated request: Issue an authenticated HTTP GET request to the top_uploads report endpoint using the moderator session credentials or API key.
4. Retrieve file URLs: The server incorrectly permits the request and returns a list of direct URLs to all uploaded files on the platform, including user data exports, admin backups, and private attachments.
5. Access sensitive files: Use the returned direct URLs to download or inspect sensitive content such as database backups, user PII exports, or private media attachments (GitHub Advisory).

• Logs: Discourse application logs showing moderator-level accounts accessing admin report endpoints (e.g., requests to /admin/reports/top_uploads or equivalent) — particularly from accounts that do not normally access admin reports.
• Network: Unusual HTTP GET requests to admin report API endpoints originating from moderator sessions, followed by outbound requests to download backup or export files from the Discourse storage URLs.
• Behavioral: A moderator account accessing the admin panel or admin API endpoints outside of normal administrative workflows, especially repeated or automated requests to the top_uploads report.

Discourse has released patched versions that restrict the top_uploads report to administrators only: 3.5.4 (stable), 2025.11.2, 2025.12.1, and 2026.1.0. There is no configuration-based workaround available. Until the patch is applied, site administrators should limit moderator privileges to fully trusted users and audit existing moderator accounts to minimize exposure risk (GitHub Advisory).

The vulnerability was disclosed via GitHub's security advisory system by Discourse maintainer davidtaylorhq on January 28, 2026. Coverage has been limited to vulnerability tracking databases and security news aggregators, with no notable independent researcher commentary or significant social media discussion identified (GitHub Advisory).