CVE-2026-27152: 
NixOS vulnerability analysis and mitigation

CVE-2026-27152 is a DM communication-preference bypass vulnerability in Discourse, an open source discussion platform. Prior to patched versions, an authenticated user could exploit the Chat::AddUsersToChannel function to add targets who have blocked, ignored, or muted them to an existing direct message (DM) channel, circumventing per-recipient private message restrictions enforced during DM channel creation. Affected versions include all releases before 2025.12.2, versions 2026.1.0 up to (but not including) 2026.1.1, and pre-release 2026.2.0 builds. It carries a CVSS v3.1 base score of 3.8 (Medium) and a CVSS v4.0 base score of 1.3 (Low) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-284 (Improper Access Control). The root cause is that the Chat::AddUsersToChannel API endpoint does not enforce the same per-recipient communication preference checks (block/ignore/mute restrictions) that are applied when a new DM channel is initially created. An authenticated user with sufficient privileges can invoke this endpoint to add users who have explicitly restricted contact from the attacker, bypassing the intended privacy controls. No public proof-of-concept or detailed technical write-up beyond the vendor advisory is currently available (GitHub Advisory).

Successful exploitation allows a privileged authenticated user to force unwanted direct message interactions on users who have explicitly blocked, ignored, or muted them, resulting in low-level confidentiality and integrity impacts. The attack requires no user interaction and can be conducted remotely over the network. There is no availability impact, and the vulnerability does not enable lateral movement or significant data exfiltration beyond the forced exposure of DM channel membership (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.038%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with high privileges on the Discourse instance (Feedly, GitHub Advisory).

Discourse has released patched versions that address this vulnerability: 2025.12.2, 2026.1.1, and 2026.2.0. Administrators should upgrade to the appropriate patched version based on their current release branch. No configuration-based workarounds are available; upgrading is the only remediation path (GitHub Advisory).

The vulnerability was published by Discourse maintainer davidtaylorhq via GitHub Security Advisories on February 26, 2026, and rated as Moderate severity. No significant independent researcher commentary, media coverage, or notable community discussion beyond standard vulnerability database indexing has been observed (GitHub Advisory).