CVE-2026-31869: 
NixOS vulnerability analysis and mitigation

CVE-2026-31869 is an information disclosure vulnerability in Discourse, the open-source discussion platform, where the ComposerController#mentions endpoint leaks hidden group membership to authenticated users. By supplying allowed_names referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer group membership based on whether the user_reasons field returns "private" for a given user. Affected versions include Discourse 2026.1.0–2026.1.1, 2026.2.0, and 2026.3.0-latest (prior to latest.1). The vulnerability was published on March 20, 2026, with patches released on March 24, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper authorization (CWE-285) combined with exposure of sensitive information to unauthorized actors (CWE-200) and authorization bypass through user-controlled keys (CWE-639). The ComposerController#mentions endpoint, used during message composition, accepts an allowed_names parameter that can reference hidden-membership groups. When an authenticated user with messaging permissions to the group probes arbitrary usernames via this endpoint, the API response's user_reasons field returns "private" specifically for actual group members, effectively acting as a membership oracle. No special privileges beyond basic authentication and the ability to message the group are required to exploit this flaw (GitHub Advisory).

Successful exploitation allows any authenticated user with messaging access to a hidden-membership group to systematically enumerate all members of that group, bypassing Discourse's group member-visibility controls. The impact is limited to confidentiality — specifically the disclosure of organizational membership structures and private group compositions that administrators intended to keep hidden. There is no integrity or availability impact, and no evidence of lateral movement potential beyond the information disclosure itself (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a low-privilege authenticated account with messaging access to the target group, making it relatively accessible to any registered forum user who meets that condition (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a Discourse instance running a vulnerable version (2026.1.0–2026.1.1, 2026.2.0, or 2026.3.0-latest prior to latest.1) and register or obtain an authenticated account with permission to message a target hidden-membership group.
2. Identify target group: Determine the name or slug of a hidden-membership group on the platform (e.g., via public group listings or forum metadata that exposes group names without revealing members).
3. Craft API request: Send an authenticated HTTP request to the ComposerController#mentions endpoint, supplying the hidden group name in the allowed_names parameter and a candidate username to probe, e.g.:

   GET /composer/mentions?allowed_names[]=<hidden-group>&usernames[]=<candidate-username>

4. Analyze response: Inspect the user_reasons field in the JSON response. If the candidate username is a member of the hidden group, the API returns "private" for that user; non-members receive a different response or no entry.
5. Enumerate members: Repeat step 3–4 with a list of known or guessed usernames (e.g., from public post history) to systematically map out the full membership of the hidden group (GitHub Advisory).

• Network: Repeated authenticated GET or POST requests to the /composer/mentions endpoint with allowed_names parameters referencing hidden groups; high-frequency probing of this endpoint with varying usernames[] values from a single authenticated session.
• Logs: Discourse application logs showing a single user account making an unusually high volume of requests to the mentions endpoint in a short time window, particularly with systematic username enumeration patterns.
• Behavioral: A single authenticated user account querying the mentions endpoint with dozens or hundreds of different usernames referencing the same hidden group name within a brief period, which is inconsistent with normal composer autocomplete usage (GitHub Advisory).

Discourse has released patched versions 2026.1.2, 2026.2.1, and 2026.3.0-latest.1 that address this vulnerability. Administrators should upgrade to the appropriate patched version as the primary remediation. As an immediate workaround prior to patching, restrict the messageable policy of any hidden-membership group to staff or group members only, which prevents untrusted authenticated users from reaching the vulnerable code path in ComposerController#mentions (GitHub Advisory).

The vulnerability was assigned a "Moderate" severity rating by the Discourse security team and published via GitHub Security Advisories. No significant public researcher commentary, media coverage, or notable social media discussion has been identified beyond standard CVE aggregator coverage (GitHub Advisory).