CVE-2026-27162: 
NixOS vulnerability analysis and mitigation

CVE-2026-27162 is an information disclosure vulnerability in Discourse, the open source discussion platform, where the posts_nearby function improperly exposes whisper posts to unauthorized users. The flaw was disclosed on February 26, 2026, and affects all Discourse versions prior to 2025.12.2, versions 2026.1.0 through 2026.1.1 (exclusive), and the 2026.2.0 release branch before the patch. It carries a CVSS v3.1 base score of 4.9 (Medium) and a CVSS v4.0 base score of 4.9 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The posts_nearby function correctly checked topic-level access permissions but then returned all post types — including whisper posts — without applying post-type-level permission filtering. The fix involves using Post.secured(guardian) to enforce permission-based filtering on post types before returning results. Exploitation requires network access and at minimum low-privilege authentication (per CVSSv4), allowing an authenticated user to query the posts_nearby endpoint and retrieve whisper content not intended for them (GitHub Advisory).

Successful exploitation allows an authenticated attacker to read whisper posts — private, staff-only or restricted communications within a Discourse forum — that they are not authorized to view. The confidentiality impact is rated High, while integrity and availability are unaffected. This could expose sensitive internal discussions, moderation notes, or confidential staff communications to regular or low-privileged users (GitHub Advisory, Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.034%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated session, limiting the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory).

1. Authentication: Log in to a vulnerable Discourse instance with any valid user account (low-privilege access is sufficient per CVSSv4 assessment).
2. Identify target topic: Locate a topic that contains whisper posts — these are typically staff-only replies visible only to users with whisperer permissions.
3. Query posts_nearby endpoint: Send an authenticated HTTP request to the posts_nearby API endpoint referencing a post ID within or adjacent to the target topic.
4. Retrieve whisper content: Due to the missing Post.secured(guardian) filter, the API response includes whisper posts alongside regular posts, exposing their content to the requesting user regardless of their whisper permissions (GitHub Advisory).

• Network: Unusual or repeated authenticated API requests to the posts_nearby endpoint, particularly from accounts that do not have whisperer roles.
• Logs: Discourse application logs showing posts_nearby queries returning whisper-type posts to non-whisperer user accounts; access log entries with high frequency calls to the endpoint from a single user.
• Behavioral: Regular user accounts accessing whisper post content as evidenced in audit logs or post view tracking within Discourse's admin panel.

Discourse has released patched versions addressing this vulnerability: 2025.12.2, 2026.1.1, and 2026.2.0 (and later). Administrators should upgrade their Discourse installations to one of these versions immediately. No configuration-based workarounds are available for unpatched versions — upgrading is the only remediation (GitHub Advisory).

A technical write-up was published at infinitsec.net shortly after disclosure, describing the vulnerability as "Discourse doesn't prevent whispers to leak in excerpts." The vulnerability was indexed by multiple security databases including ENISA's EUVD (EUVD-2026-8892) and INCIBE-CERT. No significant broader media coverage or notable researcher commentary beyond standard database indexing has been observed.