CVE-2026-26979: 
NixOS vulnerability analysis and mitigation

CVE-2026-26979 is a missing authorization vulnerability in Discourse, the open source discussion platform, that allows Trust Level 4 (TL4) users to close, archive, and pin topics in private categories they do not have access to. The vulnerability was published on February 26, 2026, and affects Discourse versions prior to 2025.12.2, versions 2026.1.0 up to (but not including) 2026.1.1, and versions in the 2026.2.0-latest branch prior to 2026.2.0. It carries a CVSS v3.1 base score of 2.7 (Low) and a CVSS v4.0 base score of 0.0 (GitHub Advisory, Feedly).

The root cause is classified as CWE-862 (Missing Authorization): the application fails to properly verify whether a TL4 user has access to a private category before allowing them to perform topic management actions such as closing, archiving, or pinning topics within it. The attack vector is network-based and requires no user interaction, but does require the attacker to already hold TL4 (Leader) trust level privileges on the Discourse instance. No technical write-ups or proof-of-concept code have been publicly disclosed (GitHub Advisory).

Exploitation allows a TL4 user to manipulate the state of topics in private categories they are not authorized to access — specifically closing, archiving, or pinning those topics. This could disrupt sensitive or restricted discussions, interfere with community moderation workflows, and potentially expose the existence of private category topics. There is no direct confidentiality or availability impact; the primary consequence is unauthorized integrity modification of topic states (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.036%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to already possess TL4 trust level on the target Discourse instance, significantly limiting the attack surface (Feedly, GitHub Advisory).

1. Obtain TL4 Status: The attacker must already hold or acquire Trust Level 4 (Leader) status on the target Discourse instance, either through legitimate community participation or by compromising an existing TL4 account.
2. Identify Private Categories: Browse or enumerate the Discourse instance to identify private categories that the TL4 account does not have explicit access to.
3. Locate Target Topics: Identify topic IDs within those private categories (e.g., through indirect references, search, or API enumeration).
4. Perform Unauthorized Actions: Use the Discourse web interface or API to issue close, archive, or pin actions against topics in the private categories, bypassing the expected authorization check.
5. Achieve Objective: Successfully alter the state of restricted topics, disrupting private discussions or community moderation without proper authorization (GitHub Advisory).

• Logs: Discourse application logs showing TL4 user accounts performing close, archive, or pin actions on topics in private categories they are not members of; audit log entries for topic status changes originating from unexpected user accounts.
• Application Behavior: Topics in private categories appearing closed, archived, or pinned without action by authorized moderators or administrators; discrepancies between expected and actual topic states in restricted categories.

Discourse has released patched versions addressing this vulnerability: 2025.12.2 (for the 2025.12 branch), 2026.1.1 (for the 2026.1 branch), and 2026.2.0 (for the 2026.2 branch). No workarounds are available prior to patching. Administrators should upgrade immediately and review audit logs for any unauthorized topic modifications in private categories that may have occurred before patching (GitHub Advisory).