CVE-2026-28227: 
NixOS vulnerability analysis and mitigation

CVE-2026-28227 is an authorization bypass vulnerability in Discourse, an open-source discussion platform, that allows Trust Level 4 (TL4) users to publish topics into staff-only categories by exploiting the publish_to_category topic timer feature. The vulnerability affects all Discourse versions prior to 2025.12.2, versions 2026.1.0 up to (but not including) 2026.1.1, and versions in the 2026.2.0-latest track prior to the patched release. It was disclosed on February 26, 2026, with patches released shortly after. The vulnerability carries a CVSS v3.1 base score of 2.7 (Low) and a CVSS v4.0 base score of 1.2 (Low) (GitHub Advisory, Feedly).

The root cause is classified as CWE-863 (Incorrect Authorization): the publish_to_category topic timer functionality fails to properly enforce authorization checks when a TL4 user schedules a topic for publication. Specifically, the timer mechanism does not validate whether the target category is restricted to staff only before executing the publish action, allowing the timer to bypass the access control that would normally prevent TL4 users from posting in those categories. Exploitation requires an authenticated TL4 account and the ability to set topic timers, which is a standard privilege for TL4 users on Discourse instances (GitHub Advisory).

Successful exploitation allows a TL4 user to publish content into staff-only categories, violating the integrity of access-controlled forum spaces. The impact is limited to unauthorized content creation (low integrity impact); there is no confidentiality or availability impact, and no evidence of lateral movement potential or sensitive data exposure. The primary risk is content pollution or unauthorized visibility of topics in restricted staff areas (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified. Exploitation requires a high-privilege authenticated account (TL4), which significantly limits the attacker pool (GitHub Advisory, Feedly).

1. Obtain TL4 Account: Acquire or compromise a Trust Level 4 (Leader) account on a vulnerable Discourse instance running a version prior to 2025.12.2, 2026.1.1, or 2026.2.0.
2. Create or Identify a Topic: Create a new topic or identify an existing topic owned by the TL4 account in a non-restricted category.
3. Set Topic Timer: Navigate to the topic's timer settings and configure a publish_to_category topic timer, specifying a staff-only category as the target destination.
4. Trigger Publication: Allow the timer to fire (or set it to trigger immediately), causing Discourse to publish the topic into the staff-only category without performing the expected authorization check.
5. Verify Unauthorized Posting: Confirm that the topic now appears in the staff-only category, demonstrating the bypass of access controls (GitHub Advisory).

• Logs: Discourse application logs showing a TL4 user's topic being moved or published into a staff-only category via a timer event; audit log entries for publish_to_category timer actions targeting restricted categories.
• Application Activity: Topics appearing in staff-only categories authored by non-staff (TL4) users, particularly those with a timer-based publication timestamp.
• Database: Unexpected entries in the topic_timers table where status_type corresponds to publish_to_category and the target category_id is a staff-restricted category, associated with a non-staff user account.

Discourse has released patched versions 2025.12.2, 2026.1.1, and 2026.2.0 that address this vulnerability by enforcing proper authorization checks in the publish_to_category topic timer. Administrators should upgrade to one of these versions as soon as possible. No configuration-based workarounds are available; upgrading is the only remediation (GitHub Advisory).

The vulnerability was reported by security researcher 34selen and disclosed via GitHub's security advisory system by Discourse maintainer davidtaylorhq. No significant media coverage or notable community commentary beyond standard CVE aggregator postings has been identified. Given the low severity score and limited impact, the vulnerability has not generated substantial public discussion (GitHub Advisory).