CVE-2026-27149: 
NixOS vulnerability analysis and mitigation

CVE-2026-27149 is a SQL injection vulnerability in Discourse, an open-source discussion platform, affecting the private message (PM) tag filtering functionality (list_private_messages_tag). The flaw allows authenticated attackers to bypass tag filter conditions and potentially disclose unauthorized private message metadata. Affected versions include all releases prior to 2025.12.2, 2026.1.0 through 2026.1.0 (patched in 2026.1.1), and the 2026.2.0 release (patched in 2026.3.0-latest). It was published on February 26, 2026, with a CVSS v3.1 base score of 6.5 (Medium/High) and a CVSS v4.0 base score of 4.9 (Medium) (GitHub Advisory, Red Hat CVE).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is incorporated into SQL queries without adequate sanitization or parameterization (GitHub Advisory). The vulnerable code path is the list_private_messages_tag function, which handles tag-based filtering of private messages. An attacker with a low-privilege authenticated account can craft a malicious tag parameter that manipulates the underlying SQL query, bypassing intended access controls on PM tag filters. No special configuration or elevated privileges beyond a standard user account are required to exploit this vulnerability.

Successful exploitation allows an authenticated attacker to bypass tag-based access controls on private messages, potentially exposing metadata about private message threads that the attacker should not have access to. The primary impact is a confidentiality breach — integrity and availability are not affected. While the advisory describes the exposure as limited to private message metadata (rather than full message content), this could still reveal sensitive information such as conversation participants, tags, and thread identifiers (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.03%, indicating a low probability of exploitation in the near term (Feedly). The vulnerability requires a low-privilege authenticated account, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified.

1. Reconnaissance: Identify a Discourse instance running a vulnerable version (prior to 2025.12.2, 2026.1.1, or 2026.3.0-latest) by checking version disclosure in page source or API endpoints.
2. Authentication: Obtain or register a low-privilege user account on the target Discourse instance.
3. Identify the vulnerable endpoint: Locate the private message tag filtering endpoint, which invokes the list_private_messages_tag function — typically accessible via the Discourse API or UI when filtering PMs by tag.
4. Craft malicious payload: Inject SQL syntax into the tag parameter of the PM tag filter request (e.g., manipulating the tag name field with SQL metacharacters or UNION-based payloads) to alter the underlying SQL query logic.
5. Bypass filter conditions: The injected SQL modifies the query to bypass tag-based access restrictions, causing the server to return private message metadata for threads the attacker is not authorized to view.
6. Exfiltrate metadata: Parse the API response to collect unauthorized private message metadata such as thread IDs, participant usernames, and tag associations (GitHub Advisory).

• Network: Unusual or repeated API requests to Discourse PM tag filtering endpoints (e.g., /topics/private-messages-tags/) with anomalous or malformed tag parameter values containing SQL metacharacters (', --, UNION, SELECT, etc.).
• Logs: Discourse application logs or database query logs showing malformed SQL queries or errors originating from the list_private_messages_tag function; unexpected query patterns involving UNION statements or boolean conditions in PM tag queries.
• Logs: Authentication logs showing a low-privilege user account making an unusually high volume of requests to PM tag filtering endpoints across multiple users or tags.
• Process/Application: Database error messages or stack traces related to SQL parsing failures in the Discourse Rails application logs, potentially indicating attempted but failed injection attempts.

Discourse has released patched versions: 2025.12.2, 2026.1.1, and 2026.3.0-latest (which supersedes the initially listed 2026.2.0 patch). Administrators should upgrade to one of these versions immediately. No configuration-based workarounds are available for this vulnerability — upgrading is the only remediation (GitHub Advisory). Discourse Cloud instances are typically updated automatically by the Discourse team.

The vulnerability was assigned and published by GitHub Security (GitHub_M) on February 26, 2026, with the advisory authored by Discourse maintainer davidtaylorhq (GitHub Advisory). Coverage was picked up by several vulnerability aggregation services including Vulners, CIRCL, VulDB, and ENISA's EUVD shortly after disclosure. A brief mention appeared on Bluesky via the CVE tracking account. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability database indexing.