CVE-2026-26265: 
NixOS vulnerability analysis and mitigation

CVE-2026-26265 is an Insecure Direct Object Reference (IDOR) vulnerability in the directory items endpoint of Discourse, an open-source discussion platform. It allows any user — including unauthenticated anonymous users — to retrieve private user field values for all users in the directory by supplying arbitrary user_field_ids values without authorization checks. Affected versions include all releases prior to 2025.12.2, 2026.1.1, and 2026.2.0. The vulnerability was published on February 26, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is Incorrect Authorization (CWE-863) combined with Authorization Bypass Through User-Controlled Key (CWE-639). The user_field_ids parameter in DirectoryItemsController#index accepts arbitrary user field IDs without performing any authorization check, bypassing the visibility restrictions (show_on_profile / show_on_user_card) that are correctly enforced elsewhere in the application — for example, in UserCardSerializer via Guardian#allowed_user_field_ids. An attacker can issue a simple unauthenticated HTTP GET request to /directory_items.json?period=all&user_field_ids=<id> with any private field ID, and the endpoint returns that field's value for every user in the directory. No special privileges, authentication, or complex preconditions are required (GitHub Advisory).

Successful exploitation enables bulk exfiltration of private user data — including phone numbers, physical addresses, and other sensitive custom fields — that administrators have explicitly configured as non-public. Because the endpoint returns data for every user in the directory in a single request, an attacker can harvest the private field values of the entire user base with minimal effort. There is no integrity or availability impact; the vulnerability is purely a confidentiality breach affecting all registered users whose profiles contain private custom fields (GitHub Advisory, Red Hat CVE).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.032%, reflecting a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the trivial nature of exploitation — a single unauthenticated GET request — means the barrier to abuse is extremely low if the vulnerability becomes more widely known.

1. Reconnaissance: Identify a Discourse instance running a vulnerable version (prior to 2025.12.2, 2026.1.1, or 2026.2.0) with the user directory enabled (enable_user_directory set to true).
2. Enumerate user field IDs: Probe the directory endpoint with incrementing integer IDs (e.g., user_field_ids=1, user_field_ids=2, etc.) to discover which field IDs exist and return data.
3. Request private field data: Issue an unauthenticated HTTP GET request targeting a private field ID:

   GET /directory_items.json?period=all&user_field_ids=<private_field_id>

4. Harvest bulk data: Parse the JSON response, which includes the private field value for every user in the directory, enabling mass exfiltration of sensitive data such as phone numbers or addresses (GitHub Advisory).

• Network: Repeated or automated GET requests to /directory_items.json with varying user_field_ids parameter values, especially from unauthenticated sessions or a single IP address.
• Logs: Web server or application access logs showing requests to /directory_items.json?period=all&user_field_ids=<integer> from anonymous users or unfamiliar IP addresses; sequential enumeration of user_field_ids values across multiple requests.
• Behavioral: Unusually high volume of requests to the directory endpoint in a short time window, consistent with automated scraping of user data.

Discourse has released patched versions 2025.12.2, 2026.1.1, and 2026.2.0, which fix the issue by filtering user_field_ids against UserField.public_fields for non-staff users before building the custom field map. Administrators who cannot immediately upgrade should apply one of the following workarounds: (1) remove sensitive data from private user fields, or (2) disable the user directory entirely via the enable_user_directory site setting. Upgrading to a patched version is the recommended long-term remediation (GitHub Advisory).

The vulnerability was noted in security community feeds and aggregators shortly after disclosure, including mentions on Mastodon and Bluesky. Coverage was primarily limited to automated CVE tracking services and vulnerability databases, with no major independent security research publications identified at this time (GitHub Advisory).