CVE-2026-27153: 
NixOS vulnerability analysis and mitigation

CVE-2026-27153 is an incorrect authorization vulnerability in Discourse, an open source discussion platform, that allows authenticated moderators to export private user Chat direct messages (DMs) via the CSV export endpoint. The flaw exists in the can_export_entity? method, which used an overly permissive denylist approach rather than an explicit allowlist. Affected versions include all releases prior to 2025.12.2, versions 2026.1.0 through 2026.1.0 (before 2026.1.1), and pre-release 2026.2.0 builds. It was disclosed on February 26, 2026, with a CVSS v3.1 base score of 2.7 (Low) and a CVSS v4.0 base score of 1.3 (Low) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-863 (Incorrect Authorization). The can_export_entity? method in Discourse's CSV export endpoint was implemented using a denylist — permitting export of any entity not explicitly blocked — rather than a secure allowlist that restricts exports to only explicitly permitted entity types. This design flaw allows a moderator (an authenticated, privileged role) to craft a request to the CSV export endpoint specifying a Chat DM entity type, which is not on the blocklist, thereby bypassing the intended access restriction. No public proof-of-concept exploit code has been reported (GitHub Advisory).

Successful exploitation allows authenticated moderators to access and export private Chat DM conversations between users that they should not be authorized to view, resulting in unauthorized disclosure of private communications. The impact is limited to data confidentiality and integrity concerns — specifically, the exposure of sensitive user-to-user messages — with no effect on system availability. There is no evidence of lateral movement potential or system-level compromise, as the vulnerability is scoped to the data export functionality within the Discourse application (GitHub Advisory, Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires the attacker to already hold a moderator role within the Discourse instance, significantly limiting the attack surface. The EPSS score is approximately 0.038%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and exploit maturity is rated as "Unreported" (GitHub Advisory).

1. Obtain Moderator Access: Authenticate to the target Discourse instance using an account with moderator privileges (either legitimately assigned or through account compromise).
2. Identify the CSV Export Endpoint: Locate the CSV export API endpoint within the Discourse admin/moderator interface, which is used to export user data in CSV format.
3. Craft a Malicious Export Request: Submit a request to the CSV export endpoint specifying a Chat DM entity type (e.g., chat_message or equivalent) that is not explicitly blocked by the can_export_entity? denylist but is not intended to be accessible to moderators.
4. Receive Exported Data: The server processes the request without proper authorization enforcement and returns a CSV file containing private Chat DM conversations between users.
5. Exfiltrate Private Communications: The moderator can now read, store, or share the exported private user messages outside the platform (GitHub Advisory).

• Logs: Discourse application logs showing CSV export requests from moderator accounts targeting Chat DM entity types; unusual or repeated export requests from a single moderator account in a short timeframe.
• Network: HTTP requests from moderator sessions to the CSV export endpoint with entity parameters referencing chat or direct message data.
• Application Activity: Audit log entries (if enabled) recording data export actions by moderator-level users, particularly for entity types outside normal administrative export workflows (GitHub Advisory).

Discourse has released patched versions that address this vulnerability by replacing the denylist approach in can_export_entity? with an explicit allowlist. Administrators should upgrade to version 2025.12.2, 2026.1.1, or 2026.2.0 as appropriate for their release track. No configuration-based workarounds are available; patching is the only remediation. As a precautionary measure, administrators should review access logs for any suspicious CSV export activity from moderator accounts prior to patching (GitHub Advisory).