CVE-2026-21865: 
NixOS vulnerability analysis and mitigation

CVE-2026-21865 is a missing authorization vulnerability in Discourse, an open-source discussion platform, that allows moderators to convert private personal messages into public topics without proper authorization. Disclosed on January 28, 2026, it affects Discourse versions prior to 3.5.4 (stable), 2025.11.2, 2025.12.1, and 2026.1.0. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization) — the application fails to properly enforce access controls when moderators attempt to convert personal messages to public topics. Specifically, the topic conversion functionality does not verify whether the moderator has the necessary permissions to access the personal message being converted, allowing the action to proceed when it should be blocked. Exploitation requires an authenticated moderator account and is performed over the network with low attack complexity (GitHub Advisory).

Successful exploitation allows moderators to expose the contents of private personal messages by converting them into publicly visible topics, resulting in high confidentiality and integrity impact. Sensitive private communications between users — which may include personal, organizational, or confidential information — can be made accessible to all forum members or the public. There is no availability impact, and the scope is unchanged, meaning the vulnerability is contained to the Discourse instance itself (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a privileged moderator account, which significantly limits the attack surface (GitHub Advisory).

1. Obtain Moderator Access: Attacker must already possess or compromise a moderator-level account on the target Discourse instance.
2. Identify Target Personal Message: Locate a personal message thread that the moderator should not have access to convert — typically one involving users outside the moderator's permitted scope.
3. Invoke Topic Conversion: Use the Discourse moderator interface or API to trigger the "convert personal message to public topic" functionality on the identified message thread.
4. Bypass Authorization Check: Due to the missing authorization control, the application processes the conversion request without verifying the moderator's permission to access that specific personal message.
5. Expose Private Content: The personal message is converted to a public topic, making its contents visible to all users or the general public on the forum (GitHub Advisory).

• Logs: Discourse application logs showing moderator accounts performing topic conversion actions (convert_topic or similar API calls) on personal message threads, particularly for messages they are not participants in.
• Database/Audit: Audit log entries recording personal messages being converted to public topics by moderator accounts, especially in bulk or targeting sensitive user conversations.
• Application Events: Unexpected public topics appearing in the forum that contain content previously only visible in private message threads, attributed to moderator conversion actions.

Discourse has released patched versions: 3.5.4 (stable), 2025.11.2, 2025.12.1, and 2026.1.0 — upgrading to any of these versions is the recommended remediation. As an interim workaround, site administrators can revoke the moderation role from untrusted moderators or remove the moderator group from the "personal message enabled groups" site setting until the instance is upgraded (GitHub Advisory).

The vulnerability was assigned a "Moderate" severity rating by the Discourse maintainer (davidtaylorhq) who published the GitHub Security Advisory on January 28, 2026. Coverage has been limited to vulnerability aggregator sites and security news feeds, with no notable independent researcher commentary or significant social media discussion identified (GitHub Advisory).