CVE-2026-28218: 
NixOS vulnerability analysis and mitigation

CVE-2026-28218 is a fail-open access control vulnerability in the Discourse Data Explorer plugin that allows any authenticated user to execute SQL queries lacking explicit group assignments, including built-in system queries. It affects Discourse versions prior to 2025.12.2, versions 2026.1.0 up to (but not including) 2026.1.1, and versions 2026.2.0-latest prior to 2026.2.0. The vulnerability was published on February 26, 2026, and patched versions were released the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper access control (CWE-284) in the discourse-data-explorer plugin, where the access control logic defaults to permitting access (fail-open) when a Data Explorer query has no explicit group assignments. This means any authenticated user — regardless of their role or group membership — can invoke SQL queries that were intended to be restricted, including built-in system queries. The attack vector is network-based, requires only low privileges (a valid authenticated session), and no user interaction or special conditions are needed (GitHub Advisory).

Successful exploitation allows authenticated users to execute arbitrary pre-defined SQL queries against the Discourse database, potentially exposing sensitive forum data such as user information, private messages, email addresses, and other internal records. The confidentiality impact is rated low-to-moderate, with no direct integrity or availability impact assessed. However, depending on the content of the accessible queries, data exposure could be significant in forums handling sensitive community or organizational information (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-28218. The EPSS score is approximately 0.031% (0.000310), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid authenticated account on the target Discourse instance, making it accessible to any registered forum member (GitHub Advisory).

1. Reconnaissance: Identify a Discourse instance running a vulnerable version (prior to 2025.12.2, or 2026.1.0–2026.1.0, or 2026.2.0-latest prior to 2026.2.0) with the discourse-data-explorer plugin enabled.
2. Authentication: Register or log in to the Discourse forum with any standard user account — no elevated privileges are required.
3. Access Data Explorer: Navigate to the Data Explorer plugin interface (typically at /admin/plugins/explorer or equivalent endpoint accessible to authenticated users).
4. Identify unprotected queries: Browse available SQL queries that have no explicit group permissions assigned, including built-in system queries.
5. Execute queries: Run the unprotected SQL queries to retrieve database contents, potentially exposing user records, private messages, email addresses, or other sensitive data stored in the Discourse database (GitHub Advisory).

• Logs: Unusual or unexpected access to the Data Explorer plugin (/admin/plugins/explorer) by non-admin or non-privileged user accounts in Discourse application logs.
• Logs: Execution of built-in system SQL queries by user accounts that are not members of any authorized group, visible in Discourse audit logs or database query logs.
• Network: HTTP requests from standard user accounts to Data Explorer API endpoints (e.g., /admin/plugins/explorer/queries/:id/run) that would not normally be expected from those accounts.

Discourse has released patched versions 2025.12.2, 2026.1.1, and 2026.2.0 that address the fail-open access control issue. Administrators unable to upgrade immediately should apply one of two workarounds: explicitly assign group permissions to every Data Explorer query that currently has no group assignments (including built-in system queries), or disable the discourse-data-explorer plugin entirely until the patch can be applied. Upgrading to a patched version is the recommended long-term solution (GitHub Advisory).