CVE-2026-27936: 
NixOS vulnerability analysis and mitigation

CVE-2026-27936 is an incorrect authorization vulnerability in Discourse, the open-source discussion platform, that allows restricted post action counts to be disclosed to non-privileged users through a carefully crafted request. It affects Discourse versions 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0-latest (prior to the patched releases). The vulnerability was published on March 19, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-863 (Incorrect Authorization) — the application fails to properly enforce access controls when responding to certain crafted requests for post action count data. An unauthenticated, remote attacker can send a specially crafted network request to the Discourse API or endpoint that returns post action counts, bypassing the restriction logic intended to hide this data from non-privileged users. No authentication or user interaction is required, and attack complexity is low, making the vulnerability straightforward to exploit. No public technical write-up or proof-of-concept code has been identified (GitHub Advisory).

Successful exploitation results in unauthorized disclosure of restricted post action counts — metrics reflecting user interactions with posts (e.g., likes, flags, or other actions) that platform administrators have configured to be visible only to privileged users. The impact is limited to confidentiality (low), with no integrity or availability consequences. While the exposed data is not highly sensitive in isolation, it could reveal moderation activity, user behavior patterns, or community dynamics that were intentionally restricted, potentially enabling targeted social engineering or reconnaissance against platform users (GitHub Advisory, Red Hat CVE).

There is no known public proof-of-concept exploit, and no evidence of active in-the-wild exploitation has been reported as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. No threat actor attribution has been identified (GitHub Advisory).

Discourse has released patched versions that address this vulnerability: 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. Administrators running any affected version (2026.1.0–2026.1.1, 2026.2.0, or 2026.3.0-latest) should upgrade immediately. No configuration-based workarounds are available; patching is the only remediation strategy (GitHub Advisory).