CVE-2026-27935: 
NixOS vulnerability analysis and mitigation

CVE-2026-27935 is an information disclosure vulnerability in Discourse, the open-source discussion platform, where an API endpoint leaks private topic metadata of admin users to moderator users who do not have authorized access to those private topics. The vulnerability affects Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, spanning the 2026.1.x and 2026.2.x release tracks as well as the latest channel. It was disclosed on March 19, 2026, with patches released on March 23, 2026. The CVSS v3.1 base score is 6.5 (Medium), and the CVSS v4.0 base score is 6.9 (Medium) (GitHub Advisory, Feedly).

The root cause is an Insecure Direct Object Reference (IDOR) / missing authorization check (CWE-201: Insertion of Sensitive Information Into Sent Data) in the CreditStatusChecker service within the discourse-ai plugin. The check_agents, check_personas, and check_llm_models methods performed unscoped database lookups — querying AI agents, personas, and LLM model metadata by ID without validating whether the requesting user had group-level access to those resources. The fix involved passing the guardian (Discourse's authorization object) into the CreditStatusChecker service and filtering results to only include resources the authenticated user is permitted to access, as well as restricting LLM model metadata exclusively to staff users (GitHub Commit c0f6e9a, GitHub Commit d8dbb4c, GitHub Commit f37e4fd). Exploitation requires only a valid authenticated session (moderator-level or any logged-in user), with no user interaction needed.

Successful exploitation allows an authenticated moderator or lower-privileged user to enumerate and read metadata about private admin topics, AI personas, AI agents, and LLM model configurations that they are not authorized to access. The impact is limited to confidentiality — there is no integrity or availability impact — but the exposed metadata could reveal sensitive administrative discussions, AI configuration details (including which LLM models are deployed and their credit allocations), and internal platform structure. This information could be leveraged for further targeted attacks or social engineering against administrators (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.039% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account on the Discourse instance (moderator or any logged-in user), making mass exploitation less likely but insider threat scenarios relevant.

1. Obtain authenticated access: Log in to the target Discourse instance with any moderator-level (or lower-privileged) account.
2. Identify the vulnerable endpoint: Target the AI credits status API endpoint at GET /discourse-ai/credits/status.json.
3. Enumerate AI agent/persona IDs: Send requests with incremental or guessed agent_ids or persona_ids parameters (e.g., GET /discourse-ai/credits/status.json?agent_ids[]=1&agent_ids[]=2) to probe for valid IDs.
4. Extract restricted metadata: For each valid ID returned, the response will include metadata (persona name, LLM model details, credit allocations, feature configurations) for resources the user should not have access to.
5. Query LLM model metadata: Similarly, supply llm_model_ids parameters to retrieve LLM model credit status and configuration details that should be restricted to staff users.
6. Leverage disclosed information: Use the harvested metadata (e.g., admin topic context, AI configuration) for further reconnaissance, privilege escalation attempts, or social engineering (GitHub Commit c0f6e9a, GitHub Advisory).

• Network: Unusual or repeated GET requests to /discourse-ai/credits/status.json from moderator or non-admin accounts, especially with sequential or enumerated agent_ids, persona_ids, or llm_model_ids parameters.
• Logs: Discourse application logs showing high-frequency API calls to the credits status endpoint from a single authenticated user; access patterns inconsistent with normal moderator activity.
• Logs: Requests to /discourse-ai/credits/status.json with llm_model_ids parameters originating from non-staff user sessions (pre-patch behavior would return data; post-patch returns empty).

Discourse has released patches in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. Administrators should upgrade to the appropriate patched version for their release track immediately. There are no known workarounds available — patching is the only remediation option (GitHub Advisory, Feedly).