CVE-2026-27454: 
NixOS vulnerability analysis and mitigation

CVE-2026-27454 is a missing authorization vulnerability in Discourse, an open-source discussion platform, that allows unauthenticated attackers to read hidden post revisions by enumerating version numbers via the /posts/:id.json?version=X endpoint. Disclosed on March 19, 2026, it affects Discourse versions 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0-latest (pre-patch). It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is CWE-862 (Missing Authorization) in the display_post method within app/controllers/posts_controller.rb. The vulnerable code called post.revert_to(params[:version].to_i) directly without first looking up the corresponding PostRevision record or invoking guardian.ensure_can_see! to verify visibility permissions — a check that was already correctly implemented in the separate /posts/:id/revisions/:revision endpoint. The fix adds a PostRevision.find_by lookup followed by guardian.ensure_can_see!(post_revision) before allowing the revert, closing the authorization gap (GitHub Advisory, Patch Commit).

Successful exploitation allows any unauthenticated user to read post revision content that staff members have intentionally hidden, potentially exposing administrative notes, moderation decisions, sensitive edits, or other confidential information embedded in post history. The impact is limited to confidentiality — there is no integrity or availability impact — but the exposure of staff-concealed content could undermine trust, reveal internal moderation processes, or disclose sensitive community information (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by anyone who can reach the Discourse instance. The EPSS score is approximately 0.03% (0.000300), indicating a low probability of exploitation in the near term, and it is not listed in the CISA KEV catalog (GitHub Advisory).

1. Identify target: Locate a Discourse instance running a vulnerable version (2026.1.0–2026.1.1, 2026.2.0, or 2026.3.0-latest pre-patch) that is publicly accessible.
2. Identify post IDs: Browse the Discourse forum to collect numeric post IDs from visible posts (e.g., from post URLs or API responses).
3. Enumerate version numbers: For each target post ID, send unauthenticated HTTP GET requests incrementing the version parameter: GET /posts/<id>.json?version=1, GET /posts/<id>.json?version=2, etc.
4. Extract hidden revision content: Parse the JSON response body for each request — if a hidden revision exists at that version number, the server returns its full content without authorization checks, exposing the concealed edit history.
5. Collect sensitive data: Aggregate responses to reconstruct the full edit history of targeted posts, including any content that staff intentionally hid (GitHub Advisory, Patch Commit).

• Network: Repeated unauthenticated HTTP GET requests to /posts/<id>.json?version=<N> with sequentially incrementing version numbers from the same source IP.
• Logs: Web server or application access logs showing a pattern of requests to the /posts/*.json endpoint with varying version query parameters, particularly from unauthenticated sessions or anonymous users.
• Logs: High volume of requests targeting multiple post IDs with version enumeration in a short time window, consistent with automated scanning behavior.

Upgrade Discourse to one of the patched versions: 2026.1.2 (for the 2026.1.x branch), 2026.2.1 (for the 2026.2.x branch), or 2026.3.0-latest.1 (for the 2026.3.x branch). No configuration-based workarounds are available for unpatched versions. Instances hosting sensitive discussions or staff-only forums where post revision history may contain confidential information should be prioritized for immediate patching (GitHub Advisory).