CVE-2026-23743: 
NixOS vulnerability analysis and mitigation

CVE-2026-23743 is an information disclosure vulnerability in Discourse, the open-source discussion platform, where permalinks pointing to access-restricted resources leak resource slugs to unauthorized users. Affected versions include all stable releases prior to 3.5.4, versions 2025.11.0 through 2025.11.1, version 2025.12.0, and pre-release 2026.1.0 builds prior to the patched release. The vulnerability was published on January 28, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). When a user without access rights requests a permalink to a restricted resource — such as a private topic, category, post, or hidden tag — Discourse's permalink redirect logic resolves the resource slug and includes it in the HTTP Location redirect header and the 404 page's search box, without first verifying the requesting user's authorization to view that resource. This flaw requires no authentication, no special privileges, and no user interaction, making it trivially exploitable over the network by any party who can send HTTP requests to the Discourse instance (GitHub Advisory).

Successful exploitation results in unauthorized disclosure of sensitive metadata, such as private topic titles, category names, post slugs, or hidden tag names, to any unauthenticated network-accessible attacker. While the vulnerability does not allow reading the full content of restricted resources, the leaked slugs can reveal confidential organizational information, internal project names, or sensitive discussion topics. There is no integrity or availability impact; the risk is confined to confidentiality of resource metadata (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-23743. The EPSS score is approximately 0.042% (0.000420), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly, GitHub Advisory).

1. Reconnaissance: Identify a publicly accessible Discourse instance running a vulnerable version (prior to 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0) that uses permalinks and hosts private topics, categories, posts, or hidden tags.
2. Identify permalink structure: Observe or enumerate permalink URL patterns used by the Discourse instance (e.g., /t/some-slug or custom permalink paths configured by administrators).
3. Send unauthenticated request: Issue an HTTP GET request to a known or guessed permalink URL for a restricted resource without any authentication credentials.
4. Capture the redirect: Inspect the HTTP response — specifically the Location header in the redirect response — which will contain the resource slug (e.g., the private topic title encoded in the URL).
5. Extract sensitive metadata: Alternatively, observe the 404 page's search box, which may be pre-populated with the resource slug, further exposing the sensitive title or name of the restricted resource (GitHub Advisory).

• Network: Unusual volume of unauthenticated HTTP GET requests to permalink URLs (e.g., /t/<slug> or custom permalink paths) from a single IP or distributed sources, particularly targeting paths associated with private or restricted content.
• Logs: Web server or application access logs showing repeated 301/302 redirect responses to unauthenticated requests for permalink URLs, followed by 404 responses; patterns of systematic enumeration of permalink paths.
• Logs: Discourse application logs showing permalink resolution for resources that the requesting user does not have permission to access.

Discourse has released patched versions that address this vulnerability: 3.5.4 (stable), 2025.11.2, 2025.12.1, and 2026.1.0. Administrators should upgrade to one of these versions as soon as possible. No configuration-based workarounds are available; the vendor explicitly states there is no workaround, and sites using permalinks to private content should prioritize upgrading immediately (GitHub Advisory).

The vulnerability was noted on Mastodon via The Hacker Wire account shortly after disclosure, indicating minor social media coverage. No significant vendor statements beyond the official GitHub security advisory, nor notable independent researcher commentary, have been identified for this vulnerability (Feedly).