CVE-2026-26973: 
NixOS vulnerability analysis and mitigation

CVE-2026-26973 is an Insecure Direct Object Reference (IDOR) vulnerability in Discourse's ReviewableNotesController that allows category moderation group members to create or delete notes on any reviewable in the system, including those outside their assigned categories. It affects Discourse versions prior to 2025.12.2, versions 2026.1.0 up to (but not including) 2026.1.1, and versions 2026.2.0-latest prior to the patched 2026.2.0 release. The vulnerability is only present when the enable_category_group_moderation site setting is enabled; staff users (admins/moderators) are not affected. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an authorization bypass through user-controlled key (CWE-639) combined with incorrect authorization (CWE-863). The ReviewableNotesController used an unscoped Reviewable.find query to look up reviewable objects by ID, and the ensure_can_see guard only validated whether the requesting user had general access to the review queue — not whether they had permission to access the specific reviewable identified by the user-supplied ID. This means any authenticated user in a category moderation group could supply an arbitrary reviewable ID in their request and successfully create or delete notes on it, bypassing category-level access controls entirely (GitHub Advisory).

A category moderation group member can exploit this vulnerability to create or delete moderation notes on any reviewable item across the entire Discourse platform, regardless of which categories they are authorized to moderate. This compromises the integrity of the moderation workflow — an attacker could plant false documentation, delete legitimate moderation notes to obstruct ongoing moderation activities, or gain visibility into review queue items from categories they should not access. There is no confidentiality or availability impact; the primary risk is unauthorized modification of moderation records (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires the attacker to be an authenticated user belonging to a category moderation group, and the target instance must have enable_category_group_moderation enabled, limiting the attack surface. The EPSS score is approximately 0.026%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat CVE).

1. Identify a vulnerable instance: Locate a Discourse forum running a version prior to 2025.12.2, 2026.1.1, or 2026.2.0 with enable_category_group_moderation enabled.
2. Obtain category moderator access: Register or use an existing account that belongs to at least one category moderation group, granting access to the review queue.
3. Enumerate reviewable IDs: Browse the review queue for categories the attacker is authorized to moderate to observe valid reviewable object IDs in API responses or URLs.
4. Craft a malicious request: Send an authenticated HTTP request to the ReviewableNotesController endpoint (e.g., POST /review/:reviewable_id/notes) substituting a reviewable ID from a category the attacker does not moderate.
5. Create or delete notes: Because the controller performs an unscoped Reviewable.find and only checks general queue access, the request succeeds — allowing the attacker to add false notes or delete existing legitimate notes on the targeted reviewable (GitHub Advisory).

• Logs: Discourse application logs showing authenticated requests to /review/<ID>/notes (POST or DELETE) where the reviewable ID belongs to a category not associated with the requesting user's moderation group.
• Application Data: Unexpected moderation notes appearing on reviewables in categories with no assigned group moderators, or unexplained deletion of notes from such reviewables.
• Network: API calls to ReviewableNotesController endpoints from user accounts that are not staff but are submitting requests referencing reviewable IDs outside their assigned category scope.

Discourse has released patches in versions 2025.12.2, 2026.1.1, and 2026.2.0, which scope the reviewable lookup through Reviewable.viewable_by(current_user) to enforce proper category-based access controls. Administrators who cannot immediately upgrade should disable the enable_category_group_moderation site setting as a workaround; this restricts review queue access to staff users only, eliminating the attack surface. Upgrading to a patched version is the recommended long-term remediation (GitHub Advisory).