CVE-2026-32099: 
NixOS vulnerability analysis and mitigation

CVE-2026-32099 is an information disclosure vulnerability in Discourse, an open-source discussion platform, where the hide_profile privacy setting is bypassed via the user onebox preview feature. When a user enables hide_profile, their bio, location, and website fields are still exposed to authenticated users who request a onebox for the hidden user's profile URL. The vulnerability affects Discourse versions 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0-latest (pre-patch). It was published on March 19, 2026, with patches released shortly after. The CVSS v3.1 base score is 4.3 (Moderate) per the GitHub Security Advisory, though some sources report a higher score of 6.5 (GitHub Advisory, Feedly).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The Discourse onebox feature — which generates rich link previews — fails to check whether the target user has hide_profile enabled before returning profile data. An authenticated attacker can craft a request for a onebox preview of a hidden user's profile URL, and the server responds with the user's bio, location, and website fields without enforcing the privacy restriction. No special privileges beyond a standard authenticated session are required, and exploitation requires no user interaction (GitHub Advisory).

Successful exploitation allows an authenticated attacker to retrieve personal profile information (bio, location, and website) from users who have explicitly enabled the hide_profile privacy setting, defeating the intended privacy control. The confidentiality impact is limited to these specific profile fields and does not expose credentials, private messages, or other sensitive data. However, the exposed information could enable social engineering, targeted harassment, or deanonymization of users who rely on the privacy feature for protection (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a low-privilege authenticated account, making it accessible to any registered Discourse user on an affected instance (Feedly, GitHub Advisory).

1. Authentication: Log in to a Discourse instance running a vulnerable version (2026.1.0–2026.1.1, 2026.2.0, or 2026.3.0-latest pre-patch) with any standard user account.
2. Identify target: Identify a user who has hide_profile enabled — their profile page would normally display limited or no personal information.
3. Craft onebox request: Send an authenticated HTTP request to the Discourse onebox endpoint (e.g., /onebox) with the target user's profile URL as the parameter.
4. Retrieve hidden data: Parse the onebox preview response, which will contain the target user's bio, location, and website fields despite the hide_profile setting being active.
5. Collect information: Repeat for additional hidden-profile users to enumerate personal details across the platform (GitHub Advisory).

• Logs: Discourse application logs showing repeated authenticated requests to the onebox endpoint (/onebox) targeting multiple different user profile URLs in a short time window, particularly for users with hide_profile enabled.
• Network: Unusual patterns of onebox API calls from a single authenticated session targeting user profile URLs rather than external links or topic URLs.
• Behavior: A single user account generating a high volume of onebox preview requests for internal user profile URLs, which is atypical of normal Discourse usage.

Discourse has released patches in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. Administrators should upgrade to the appropriate patched version for their release branch immediately. No configuration-based workarounds are available — patching is the only remediation path. Instances on the latest track should ensure they are running at least 2026.3.0-latest.1 (GitHub Advisory).