CVE-2026-27151: 
NixOS vulnerability analysis and mitigation

CVE-2026-27151 is a missing authorization vulnerability in Discourse, an open source discussion platform, that allows privileged users to bypass write permission checks when moving posts between topics. The move_posts action validated permissions only on the source topic, never on the destination, enabling TL4 users and category group moderators to move posts into restricted categories (e.g., read-only or group-restricted). Affected versions include all releases prior to 2025.12.2, 2026.1.0 through 2026.1.0 (fixed in 2026.1.1), and pre-patch 2026.2.0 builds. It carries a CVSS v3.1 base score of 2.7 (Low) and a CVSS v4.0 base score of 1.3 (Low) (GitHub Advisory, Red Hat CVE). The vulnerability was published on February 26, 2026, and patches were released the same day.

The root cause is CWE-862 (Missing Authorization): the move_posts action in Discourse's topic management logic called can_move_posts? to verify the actor's permissions on the source topic but omitted any equivalent write-permission check against the destination topic (GitHub Advisory). An attacker exploiting this flaw must already hold TL4 (Trust Level 4) user status or be assigned as a category group moderator — both elevated but non-administrative roles — and must be able to initiate a move_posts API action. By specifying a destination topic in a restricted category (read-only or group-write-restricted), the actor can successfully relocate posts without the server rejecting the request due to insufficient destination permissions (GitHub Advisory). No public proof-of-concept code has been identified.

Successful exploitation allows TL4 users or category group moderators to place posts into topics within categories where they have no write access, effectively circumventing access controls on read-only or group-restricted categories (GitHub Advisory). The integrity impact is limited — attackers can inject unauthorized content into restricted discussion spaces, potentially disrupting moderation workflows or polluting curated/official content areas. There is no confidentiality or availability impact, and the vulnerability does not enable lateral movement or privilege escalation beyond unauthorized post placement (Red Hat CVE).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.031%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with TL4 or category group moderator privileges, significantly limiting the attacker pool.

1. Obtain elevated privileges: Acquire a Discourse account with TL4 (Trust Level 4) status or category group moderator rights on the target instance — these are granted by administrators or earned through community participation.
2. Identify a restricted destination category: Browse the Discourse instance to locate a category with restricted write access (e.g., a read-only announcement category or a group-restricted staff category) that contains at least one topic.
3. Select source posts: Identify posts in a topic where the attacker has can_move_posts? permission (i.e., a topic in a category where they are a moderator or TL4 user).
4. Invoke the move_posts action: Send an authenticated API request or use the Discourse admin/moderator UI to invoke the move_posts action, specifying the target post IDs and setting the destination topic to one within the restricted category.
5. Bypass destination check: Because the server only validates source-topic permissions, the request succeeds and the posts are moved into the restricted destination topic without a write-permission check on the destination (GitHub Advisory).

• Logs: Discourse application logs showing move_posts actions where the destination topic belongs to a category the acting user is not authorized to write to; audit log entries for post moves initiated by TL4 users or group moderators into restricted categories.
• Application Behavior: Posts appearing in read-only or group-restricted categories that were not created by authorized users; unexpected changes to post counts or topic contents in restricted categories.
• Network: Authenticated POST requests to Discourse's move_posts API endpoint (e.g., /t/{topic_id}/move-posts) from accounts with TL4 or group moderator roles, targeting destination topics in restricted categories.

Upgrade Discourse to one of the patched versions: 2025.12.2 (for the 2025.12.x branch), 2026.1.1 (for the 2026.1.x branch), or 2026.2.0 (for the 2026.2.x branch) (GitHub Advisory). No configuration-based workarounds are available — patching is the only remediation. As an interim risk-reduction measure, administrators may consider auditing and restricting TL4 promotions and category group moderator assignments until the patch is applied.