CVE-2026-27021: 
NixOS vulnerability analysis and mitigation

CVE-2026-27021 is a missing authorization vulnerability in the Discourse open-source discussion platform's poll plugin. The voters endpoint failed to enforce post visibility checks, allowing unauthenticated attackers to access voter details for polls in any post, including private or restricted ones. It affects Discourse versions prior to 2025.12.2, versions 2026.1.0 up to (but not including) 2026.1.1, and versions in the 2026.2.x branch prior to 2026.2.0. The vulnerability was published on February 26, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-862 (Missing Authorization). The poll plugin's voters endpoint did not validate whether the requesting user had permission to view the post containing the poll before returning voter data. Because no authentication or authorization check was enforced, any network-accessible attacker could send a crafted HTTP request to the voters endpoint with a target post or poll identifier and receive voter details in response. No special privileges, user interaction, or complex preconditions are required for exploitation (GitHub Advisory).

Successful exploitation results in unauthorized disclosure of poll voter details, including which users voted on polls in private, restricted, or otherwise access-controlled posts. This constitutes an information disclosure vulnerability that can expose user voting patterns and preferences without authorization. There is no impact on integrity or availability, and no evidence of lateral movement potential beyond the data exposure itself (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.049%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify a Discourse instance running a vulnerable version (prior to 2025.12.2, 2026.1.0 before 2026.1.1, or 2026.2.x before 2026.2.0) by checking publicly visible version indicators or HTTP response headers.
2. Identify target polls: Browse the Discourse instance to enumerate post or poll identifiers, including those in public areas that may reference private polls.
3. Craft request to voters endpoint: Send an unauthenticated HTTP GET request to the poll plugin's voters endpoint (e.g., /polls/voters.json) with the target poll name and post ID as parameters, without supplying any authentication credentials or session tokens.
4. Retrieve voter data: The server returns voter details for the specified poll regardless of the post's visibility settings, exposing usernames or user identifiers of those who voted on private or restricted polls (GitHub Advisory).

• Network: Unusual unauthenticated HTTP GET requests to /polls/voters.json or equivalent poll voters API endpoints, particularly targeting post IDs associated with private or restricted categories.
• Logs: Web server or application access logs showing repeated requests to the poll voters endpoint from unauthenticated sessions (no session cookie or auth token), especially across multiple post IDs in rapid succession.
• Logs: Requests to the voters endpoint referencing post IDs that are not publicly accessible, which would not normally appear in unauthenticated traffic.

Discourse has released patched versions addressing this vulnerability: 2025.12.2 (for the stable branch), 2026.1.1 (for the 2026.1.x branch), and 2026.2.0 (for the 2026.2.x branch). Administrators should upgrade to one of these versions immediately. No configuration-based workarounds are available; patching is the only mitigation strategy (GitHub Advisory).