CVE-2026-30888: 
NixOS vulnerability analysis and mitigation

CVE-2026-30888 is an improper privilege management vulnerability in Discourse, the open-source discussion platform, that allows authenticated moderators to edit site policy documents (Terms of Service, community guidelines, and privacy policy) that they are explicitly prohibited from modifying. The vulnerability affects Discourse versions >= 2026.1.0 (before 2026.1.2), >= 2026.2.0 (before 2026.2.1), and 2026.3.0-latest (before 2026.3.0-latest.1). It was published on March 20, 2026, with patches released simultaneously. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The vulnerability is classified as CWE-269 (Improper Privilege Management), where the application's access control logic fails to enforce intended restrictions on moderator-role users. Specifically, the flaw exists in the suspend/silence endpoint, which accepts an arbitrary post_id parameter — moderators can leverage this to access and modify policy documents that should be restricted to administrators only. Exploitation requires an authenticated moderator account (high privileges), operates over the network with low attack complexity, and requires no user interaction (GitHub Advisory).

A malicious or compromised moderator could exploit this vulnerability to silently alter legally significant site policy documents, including Terms of Service, community guidelines, and privacy policies, without authorization. This could result in compliance violations, user trust erosion, and potential legal liability for organizations operating Discourse instances. The integrity impact is rated High, while confidentiality impact is Low and there is no availability impact (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.023% (0.000230), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated moderator account, which significantly limits the attack surface (GitHub Advisory, Feedly).

1. Obtain Moderator Access: Authenticate to the target Discourse instance using a moderator-level account (either legitimately assigned or compromised).
2. Identify Policy Document Post IDs: Enumerate or guess the post_id values associated with site policy documents (ToS, guidelines, privacy policy) by browsing the Discourse admin panel or using the Discourse API.
3. Craft Malicious Request: Send a crafted request to the suspend/silence endpoint, supplying the arbitrary post_id corresponding to a restricted policy document.
4. Edit Restricted Document: Leverage the authorization bypass to submit unauthorized edits to the policy document content, bypassing the access controls that should prevent moderators from modifying these pages.
5. Verify Changes: Confirm the unauthorized modification was applied by viewing the updated policy document on the Discourse instance (GitHub Advisory).

• Logs: Discourse application logs showing moderator-level accounts accessing or modifying policy document endpoints (ToS, guidelines, privacy policy) outside of normal administrative workflows.
• Audit Trail: Discourse staff action logs recording edits to site policy posts (/admin/logs/staff_action_logs) attributed to moderator accounts rather than administrator accounts.
• Application Events: Unexpected changes to the content of /tos, /faq, or /privacy pages on the Discourse instance, particularly if not initiated by an administrator.
• Network: API requests from moderator sessions targeting the suspend/silence endpoint with post_id values corresponding to policy documents (GitHub Advisory).

Upgrade Discourse to one of the patched versions: 2026.3.0-latest.1, 2026.2.1, or 2026.1.2. No configuration-based workarounds are available as an alternative to patching. As interim measures, administrators should audit all policy document edits made by moderators since the vulnerable version was deployed, review moderator access logs for unauthorized changes, and limit moderator role assignments to only fully trusted users until patching is complete (GitHub Advisory).

The advisory was published by Discourse maintainer jomaxro on GitHub with a Low severity rating. Coverage has been limited to automated vulnerability tracking services such as NVD, VulDB, CVEFeed, and ENISA's EUVD. No significant researcher commentary, vendor statements beyond the advisory, or notable media coverage has been identified for this vulnerability (GitHub Advisory).