CVE-2026-30889: 
NixOS vulnerability analysis and mitigation

CVE-2026-30889 is a missing authorization vulnerability in Discourse, the open-source discussion platform, that allows moderators to access metadata of posts they should not have permission to view. The vulnerability was published on March 20, 2026, and affects Discourse versions 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0-latest (pre-patch). It carries a CVSS v3.1 base score of 4.9 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-862 (Missing Authorization) — the platform fails to adequately validate permissions when a moderator requests sensitive post metadata, allowing access beyond their authorized scope. The attack vector is network-based, requires no user interaction, and demands high privileges (moderator-level account), making it exploitable by any authenticated moderator on the platform. The specific component affected is the discourse-user-notes plugin or related post metadata endpoint within Discourse (GitHub Advisory, Feedly).

Successful exploitation allows a malicious or compromised moderator to access post metadata beyond their authorized scope, potentially exposing private post details, user information, or other restricted content. The impact is limited to confidentiality — there is no integrity or availability impact. All posts and users on the affected Discourse instance could be affected, as the insufficient authorization check does not restrict which posts' metadata can be accessed (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Obtain moderator access: Attacker must already hold or compromise a moderator-level account on the target Discourse instance.
2. Identify restricted posts: Enumerate posts or topics that the moderator account should not have permission to view (e.g., posts in private categories or deleted posts).
3. Send crafted metadata request: Issue an authenticated API or HTTP request to the Discourse endpoint responsible for retrieving post metadata (related to discourse-user-notes or similar), referencing the ID of a restricted post.
4. Receive unauthorized data: Due to insufficient authorization checks, the server returns post metadata that should be restricted, exposing sensitive information such as user notes, post details, or other restricted content (GitHub Advisory).

• Logs: Discourse application logs showing moderator accounts making repeated or unusual requests to post metadata endpoints for posts outside their assigned categories or permissions.
• Network: HTTP requests from moderator sessions targeting post metadata API endpoints (e.g., /post_actions, /user_notes, or similar) for post IDs not associated with their moderation scope.
• Behavioral: A single moderator account accessing metadata for a high volume of diverse posts across multiple private or restricted categories in a short time window.

Discourse has released patched versions addressing this vulnerability: 2026.1.2 (for 2026.1.x branch), 2026.2.1 (for 2026.2.x branch), and 2026.3.0-latest.1 (for 2026.3.x branch). No configuration-based workaround is available; upgrading to a patched version is the only recommended remediation. Administrators should also audit moderator access logs to identify any suspicious post metadata access activity prior to patching (GitHub Advisory, Feedly).