CVE-2026-26207: 
NixOS vulnerability analysis and mitigation

CVE-2026-26207 is a missing authorization vulnerability in the discourse-policy plugin for Discourse, an open-source discussion platform. The flaw allows any authenticated user to interact with policies on posts they do not have permission to view, enabling unauthorized policy acceptance/rejection and post ID enumeration via information disclosure. It affects Discourse versions prior to 2025.12.2, versions 2026.1.0 up to (but not including) 2026.1.1, and versions 2026.2.0-latest prior to 2026.2.0. The vulnerability was published on February 26, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is a missing authorization check (CWE-862) in the PolicyController of the discourse-policy plugin. The controller loads posts by ID without invoking any visibility check for the requesting user, meaning it does not verify whether the authenticated user has permission to view the post before processing policy actions. This allows two distinct attack paths: policy group members can call accept/unaccept policy endpoints on posts in private categories or private messages they cannot access, and any authenticated user can probe post IDs to determine which ones have policies attached by observing differentiated error responses. The fix adds a guardian.can_see?(@post) check in the set_post before_action to enforce visibility before any policy operation proceeds (GitHub Advisory).

Successful exploitation results in both integrity and confidentiality impacts. Authenticated attackers who are policy group members can accept or unaccept policies on restricted posts (e.g., in private categories or private messages) without having legitimate access to that content, undermining the integrity of policy compliance records. Additionally, any authenticated user can enumerate which post IDs have policies attached by analyzing differentiated error responses, constituting an information disclosure risk that could reveal the existence of otherwise hidden content. Availability is not impacted (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.025%, reflecting a very low probability of exploitation in the near term. The vulnerability requires only a low-privilege authenticated account, making it accessible to any registered Discourse user, but the impact is constrained to policy manipulation and post ID enumeration. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

1. Authenticate: Obtain a valid low-privilege account on the target Discourse instance (e.g., a standard registered user account).
2. Enumerate post IDs: Send HTTP requests to the discourse-policy plugin's policy endpoints (e.g., /policy/accept or /policy/unaccept) with incrementing or guessed post IDs. Observe differentiated error responses — a response indicating a policy exists but access is denied differs from a response indicating no policy is present, allowing enumeration of which post IDs have policies attached.
3. Identify restricted posts: Use the enumeration results to identify post IDs in private categories or private messages that have policies attached, revealing the existence of otherwise hidden content.
4. Manipulate policy state (if policy group member): If the attacker's account belongs to a policy group, send an accept or unaccept request to the policy endpoint for a restricted post ID. Because the PolicyController does not verify post visibility, the action is processed successfully, altering the policy acceptance state on content the attacker cannot legitimately view (GitHub Advisory).

• Network: Unusual sequences of HTTP requests to Discourse policy endpoints (e.g., /policy/accept, /policy/unaccept) with sequentially or randomly varying post IDs from a single authenticated user session.
• Logs: Discourse application logs showing repeated policy action requests (accept/unaccept) from a user account against post IDs that the user does not have view permissions for; differentiated HTTP response codes (e.g., 403 vs. 404) in access logs for policy endpoint requests across many post IDs.
• Application Behavior: Policy acceptance records modified for posts in private categories or private messages by users who are not members of those categories or conversations.

Discourse has released patched versions addressing this vulnerability: 2025.12.2, 2026.1.1, and 2026.2.0. The fix introduces a guardian.can_see?(@post) check in the set_post before_action of the PolicyController, ensuring post visibility is verified before any policy action is processed. As an interim workaround for administrators unable to upgrade immediately, disabling the discourse-policy plugin by setting policy_enabled = false eliminates the vulnerability entirely; no other workaround exists without upgrading (GitHub Advisory).

The vulnerability was published by Discourse maintainer davidtaylorhq via a GitHub Security Advisory on February 26, 2026, and was subsequently tracked by Red Hat's CVE database and ENISA's EUVD. A brief technical write-up was published by Infinit Security shortly after disclosure (Infinit Security). General community reaction has been limited, consistent with the moderate severity rating and absence of active exploitation.