CVE-2026-24742: 
NixOS vulnerability analysis and mitigation

CVE-2026-24742 is an incorrect authorization vulnerability in Discourse, an open source discussion platform, that allows non-admin moderators to view sensitive information in staff action logs restricted to administrators. Disclosed on January 28, 2026, it affects Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat CVE).

The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning the platform performs an authorization check when moderators access staff action logs but does not correctly enforce the restriction to administrators only. A low-privileged authenticated user with moderator role can access the staff action logs endpoint over the network without any additional complexity or user interaction. The exposed data includes webhook payload URLs and secrets, API key details, site setting changes, private message content, restricted category names and structures, and private chat channel titles. No public proof-of-concept exploit code has been identified at this time (GitHub Advisory).

Successful exploitation allows a moderator to extract highly sensitive administrative credentials and configuration data, including webhook secrets and API keys, which could be used to spoof webhook events to integrated third-party services or escalate access beyond the Discourse platform. Private message content and restricted category structures are also exposed, creating significant confidentiality risks for platform users. There is no integrity or availability impact, but the credential leakage could enable downstream attacks on integrated services (GitHub Advisory).

No public exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-24742. The EPSS score is approximately 0.028%, indicating a low probability of exploitation in the near term. The vulnerability requires a low-privilege authenticated account (moderator role), limiting the attack surface to users who have already been granted moderator access. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat CVE).

1. Obtain Moderator Access: Gain or already possess a non-admin moderator account on a vulnerable Discourse instance (version < 3.5.4, < 2025.11.2, < 2025.12.1, or < 2026.1.0).
2. Navigate to Staff Action Logs: Log in and access the staff action logs section of the Discourse admin panel, which is accessible to moderators due to the missing authorization enforcement.
3. Extract Sensitive Data: Browse the staff action logs to collect exposed information, including webhook payload URLs and secrets, API key details, site setting changes, private message content, restricted category names, and private chat channel titles.
4. Leverage Webhook Secrets: Use extracted webhook secrets to craft and send spoofed webhook events to integrated third-party services (e.g., Slack, GitHub, CI/CD pipelines), potentially triggering unauthorized actions in those services.
5. Exploit API Keys: Use any exposed API keys to perform administrative actions on the Discourse instance or connected services beyond the moderator's intended privilege level (GitHub Advisory).

• Logs: Unusual or repeated access to staff action log endpoints (/admin/logs/staff_action_logs) by moderator-level accounts (non-admin users) in Discourse application logs.
• Logs: API requests using credentials or keys that were only visible in staff action logs, originating from unexpected IP addresses or user agents.
• Network: Unexpected webhook events sent to integrated services (e.g., Slack, GitHub) that do not correspond to legitimate Discourse administrative actions, potentially indicating webhook secret abuse.
• Application: Moderator accounts accessing admin-restricted areas of the Discourse interface at unusual times or frequencies.

Discourse has released patched versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, which restrict staff action log access to administrators only. Administrators should upgrade to one of these versions immediately. As a temporary workaround, site administrators should review all moderator appointments and limit the role to fully trusted users, as there is no configuration-based option to prevent this access in unpatched versions. Additionally, rotating any webhook secrets and API keys that may have been exposed is strongly recommended after upgrading (GitHub Advisory).

The vulnerability was published by Discourse maintainer davidtaylorhq via GitHub Security Advisories on January 28, 2026, with a moderate severity rating. Coverage has been limited to vulnerability aggregator sites and a brief write-up on Infinitsec. No significant broader media coverage or notable researcher commentary has been identified (GitHub Advisory).