CVE-2026-27150: 
NixOS vulnerability analysis and mitigation

CVE-2026-27150 is a missing authorization vulnerability in Discourse, an open source discussion platform, affecting the Data Explorer plugin's QueryGroupBookmarkable component. The flaw allows any authenticated user to create bookmarks for query groups they do not have access to, resulting in metadata disclosure via bookmark reminder notifications. It affects all Discourse versions prior to 2025.12.2, versions 2026.1.0 through 2026.1.0 (fixed in 2026.1.1), and versions prior to 2026.2.0. The vulnerability was published on February 26, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 3.8 (Low) and a CVSS v4.0 base score of 1.3 (Low) (GitHub Advisory, Red Hat CVE).

The root cause is a missing validate_before_create authorization check (CWE-862: Missing Authorization) in the QueryGroupBookmarkable class within Discourse's Data Explorer plugin. When a logged-in user attempts to create a bookmark for a query group, the application fails to invoke the guardian (permission) check to verify whether the user has access to that query group. An attacker can exploit this by sending a crafted bookmark creation request targeting a restricted query group's ID, bypassing access controls entirely. The fix also enforces that validate_before_create throws a NotImplementedError in BaseBookmarkable if not implemented, preventing similar authorization gaps in future bookmarkable implementations (GitHub Advisory).

Successful exploitation allows any authenticated Discourse user to create bookmarks for query groups outside their authorized scope, leading to metadata disclosure through bookmark reminder notifications. This means an attacker can learn the existence and metadata of restricted query groups — such as their names or identifiers — that they should not have visibility into. The impact is limited in scope: there is no availability impact, and both confidentiality and integrity impacts are rated Low, with no lateral movement potential beyond information disclosure within the Discourse platform (GitHub Advisory, Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.038%, reflecting a very low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires prior authentication, limiting the attack surface to logged-in users (GitHub Advisory).

1. Authentication: Log in to a vulnerable Discourse instance with any valid user account — no elevated privileges are required.
2. Identify target query group: Enumerate or guess the ID of a restricted Data Explorer query group that the attacker's account does not have permission to access.
3. Craft bookmark creation request: Send an HTTP POST request to the Discourse bookmark creation endpoint, specifying the target query group ID and the QueryGroupBookmarkable type, bypassing the missing validate_before_create authorization check.
4. Receive metadata via notification: Configure a bookmark reminder on the created bookmark. When the reminder triggers, the notification will include metadata about the restricted query group, disclosing information the attacker should not have access to (GitHub Advisory).

• Logs: Discourse application logs showing bookmark creation requests (POST /bookmarks) by users for query group IDs they are not members of or do not have access to.
• Database: Unexpected entries in the bookmarks table where the bookmarkable_type is QueryGroupBookmarkable and the associated user does not have access to the referenced query group.
• Notifications: Bookmark reminder notifications sent to users for query groups outside their access scope, which may appear in notification logs or email delivery logs.

Discourse has released patched versions addressing this vulnerability: 2025.12.2 (for installations on the pre-2026.1.0 track), 2026.1.1 (for the 2026.1.x branch), and 2026.2.0 (for the 2026.2.x branch). No configuration-based workarounds are available. Administrators should upgrade to the appropriate patched version immediately and audit existing bookmarks for unauthorized entries in the QueryGroupBookmarkable type (GitHub Advisory).

The vulnerability was disclosed by Discourse maintainer davidtaylorhq via a GitHub Security Advisory on February 26, 2026. Coverage has been limited to standard vulnerability aggregation platforms (NVD, Vulners, VulDB, INCIBE, Red Hat CVE database) with no notable independent researcher commentary or significant social media discussion observed beyond automated CVE notification accounts (GitHub Advisory, Red Hat CVE).