CVE-2026-27934: 
NixOS vulnerability analysis and mitigation

CVE-2026-27934 is an information disclosure vulnerability in Discourse, the open-source discussion platform, caused by missing visibility checks on a user action API endpoint. It allows unauthenticated remote attackers to retrieve private topic titles and post excerpts they are not authorized to view. Affected versions include all releases from 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0-latest (unpatched). The vulnerability was disclosed on March 19, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is a missing authorization/visibility check (CWE-201: Insertion of Sensitive Information Into Sent Data) in a user action API endpoint within Discourse. When queried, this endpoint returns post titles and excerpts without verifying whether the requesting user has permission to view the associated topic or post. Because no authentication or privilege is required, any network-accessible attacker can send a crafted API request to the vulnerable endpoint and receive restricted content in the response. No public proof-of-concept or detailed technical write-up has been identified at this time (GitHub Advisory).

Successful exploitation results in unauthorized disclosure of private or restricted discussion content — specifically topic titles and post excerpts — to unauthenticated users. This is a confidentiality-only impact with no effect on integrity or availability. Depending on the sensitivity of the forum content (e.g., internal corporate discussions, private support tickets, or confidential community topics), the exposure could facilitate targeted social engineering, competitive intelligence gathering, or privacy violations (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker if a vulnerable Discourse instance is reachable. The EPSS score is approximately 0.042%, reflecting low current exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify publicly accessible Discourse instances running versions 2026.1.0–2026.1.1, 2026.2.0, or 2026.3.0-latest (unpatched) using web search, Shodan, or Censys.
2. Identify the vulnerable endpoint: Locate the user action API endpoint (e.g., /user_actions.json or a similar Discourse API route) that returns activity data without enforcing topic/post visibility checks.
3. Send unauthenticated API request: Issue an HTTP GET request to the vulnerable endpoint without any authentication headers or session cookies, optionally specifying a target username or action type parameter.
4. Harvest disclosed content: Parse the API response to extract private topic titles and post excerpts that the requesting user should not have access to, potentially revealing sensitive discussion content (GitHub Advisory).

• Network: Unusual or high-volume unauthenticated HTTP GET requests to Discourse user action API endpoints (e.g., /user_actions.json) from external or unexpected IP addresses.
• Logs: Discourse application logs showing repeated API requests to user action endpoints without associated authenticated sessions, particularly from the same source IP across multiple usernames.
• Logs: Access log entries with HTTP 200 responses to user action API paths from unauthenticated clients (no session cookie or API key present).

Discourse has released patches in versions 2026.1.2, 2026.2.1, and 2026.3.0-latest.1. Administrators should upgrade to the appropriate patched version for their release branch immediately. No configuration-based workarounds are available; patching is the only remediation (GitHub Advisory).

The vulnerability was assigned and published by GitHub Security (GitHub_M assigner) on March 19, 2026. Brief mentions appeared on automated CVE tracking feeds including CVEfeed.io, VulDB, and Bluesky CVE notification accounts shortly after disclosure. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregator postings (Feedly).