CVE-2026-30891: 
NixOS vulnerability analysis and mitigation

CVE-2026-30891 is an unauthorized information disclosure vulnerability in Discourse, an open-source discussion platform, caused by insufficient authorization checks in the user actions endpoint. It allows an authenticated user to access another user's private activity without permission. Affected versions include Discourse 2026.1.0 up to (excluding) 2026.1.2, 2026.2.0 up to (excluding) 2026.2.1, and 2026.3.0-latest prior to 2026.3.0-latest.1. The vulnerability was published on March 20, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), stemming from missing or inadequate authorization checks in the user actions API endpoint. An authenticated attacker with low privileges can send a crafted network request to the user actions endpoint, supplying another user's identifier, and receive private activity data that should be restricted. No special conditions, user interaction, or elevated privileges beyond a standard authenticated session are required for exploitation. No public proof-of-concept code or detailed technical write-up has been identified at this time (GitHub Advisory).

Successful exploitation results in unauthorized disclosure of another user's private activity data, representing a high confidentiality impact with no integrity or availability impact. Any authenticated user on a vulnerable Discourse instance could enumerate or access private actions of other users, potentially exposing sensitive behavioral or content data. There is no evidence of lateral movement capability or code execution risk associated with this vulnerability (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

Discourse has released patches addressing this vulnerability. Users should upgrade to version 2026.1.2 or later (for the 2026.1.x branch), 2026.2.1 or later (for the 2026.2.x branch), or 2026.3.0-latest.1 or later (for the 2026.3.x branch). No configuration-based workaround is available; upgrading to a patched version is the only recommended remediation. As an interim measure, administrators may restrict Discourse access to trusted users and review access logs for any unauthorized queries to the user actions endpoint (GitHub Advisory).