CVE-2026-29072: 
NixOS vulnerability analysis and mitigation

CVE-2026-29072 is a missing authorization vulnerability in the discourse-policy plugin for Discourse, an open-source discussion platform. It allows users who do not belong to the allowed policy creation groups to create functional policy acceptance widgets in posts under certain conditions. The vulnerability was disclosed on March 19, 2026, and affects Discourse versions 2026.1.0–2026.1.1, 2026.2.0, and 2026.3.0 (latest). It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is a missing authorization check (CWE-862) in the discourse-policy plugin, which fails to properly validate whether a user belongs to the groups permitted to create policy acceptance widgets before allowing the action. An attacker can exploit this over the network without requiring any privileges or user interaction, though the attack complexity is rated High (CVSS v4.0), suggesting specific conditions must be met. The flaw allows unauthorized users to embed functional policy acceptance widgets into posts, bypassing the intended access control model of the plugin (GitHub Advisory).

Successful exploitation primarily affects the integrity of the Discourse platform's policy management system, with no impact on confidentiality or availability. Unauthorized users can create policy acceptance widgets in posts, potentially manipulating other users into accepting policies they did not intend to, or enabling social engineering attacks by falsifying policy-related content. This could undermine trust in the platform's policy enforcement mechanisms and lead to unauthorized policy modifications (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013%, indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported.

1. Identify a vulnerable instance: Locate a Discourse forum running versions 2026.1.0–2026.1.1, 2026.2.0, or 2026.3.0 with the discourse-policy plugin enabled (policy_enabled site setting active).
2. Obtain a non-privileged account: Register or log in as a user who is not a member of any group authorized to create policy acceptance widgets.
3. Craft a post with a policy widget: Under the specific conditions that bypass the authorization check, compose a post that includes the policy acceptance widget markup or API call normally restricted to authorized groups.
4. Submit the post: If the conditions are met, the platform processes the widget creation without enforcing group membership checks, resulting in a functional policy acceptance widget embedded in the post.
5. Social engineering: Use the unauthorized widget to deceive other users into accepting fabricated or manipulated policies, potentially for phishing or compliance fraud purposes (GitHub Advisory).

• Logs: Discourse application logs showing policy widget creation events (discourse-policy plugin logs) attributed to users not belonging to authorized policy creation groups.
• Database: Policy acceptance widget records in the database associated with posts authored by non-privileged users outside the configured policy creation groups.
• Application Activity: Unexpected policy acceptance prompts appearing in posts authored by regular (non-admin, non-moderator) users on the forum.

Discourse has released patched versions 2026.1.2, 2026.2.1, and 2026.3.0-latest.1 that address this vulnerability. Administrators should upgrade to one of these patched versions as the primary remediation. As an interim workaround, the discourse-policy plugin can be disabled by setting policy_enabled to false in the Discourse site settings. Additionally, administrators should review policy-related posts and widgets created by unauthorized users to assess whether any malicious activity has occurred (GitHub Advisory).