CVE-2026-32143: 
NixOS vulnerability analysis and mitigation

CVE-2026-32143 is an authorization bypass vulnerability in Discourse, the open-source discussion platform, that allows moderators to export CSV data for admin-restricted reports, circumventing report visibility restrictions. It affects versions 2026.1.0-latest through before 2026.1.3, 2026.2.0-latest through before 2026.2.2, and 2026.3.0-latest through before 2026.3.0. The vulnerability was published on March 31, 2026, and patches were released shortly after. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is improper access control (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the CSV export endpoint (/export_csv/export_entity.json). The can_export_entity? method in lib/guardian.rb did not pass report arguments (including the report name) when checking moderator permissions, meaning the Report.hidden? check was never invoked for moderator-initiated CSV exports. As a result, a moderator could POST to the export endpoint with entity: "report" and specify an admin-only report name (e.g., top_uploads) in the args parameter, successfully triggering a CSV export job without authorization. The fix, committed in 727029a, passes the args hash to can_export_entity? and enforces Report.hidden?(report_name, admin: false) for moderator requests (GitHub Commit, GitHub Advisory).

Successful exploitation allows a moderator-level authenticated user to access and download sensitive operational data from admin-restricted reports — such as upload statistics (top_uploads) — that are intentionally hidden from non-admin roles. The confidentiality impact is the primary concern, as no integrity or availability impact exists. While this does not enable remote code execution or lateral movement, it can expose internal platform metrics and operational data that administrators may consider sensitive or proprietary (GitHub Advisory, Feedly).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. Exploitation requires an authenticated moderator account on the target Discourse instance, limiting the attack surface to trusted insiders or compromised moderator credentials. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Obtain moderator access: Log in to the target Discourse instance with a moderator-level account (not admin).
2. Identify admin-only reports: Determine the names of admin-restricted reports (e.g., top_uploads) by reviewing Discourse documentation or source code, as these reports are hidden from the moderator UI.
3. Craft the export request: Send a POST request to /export_csv/export_entity.json with the following parameters:

   POST /export_csv/export_entity.json
   entity=report&args[name]=top_uploads&args[start_date]=2026-01-01&args[end_date]=2026-02-15

4. Retrieve the exported CSV: The server queues a Jobs::ExportCsvFile job and returns HTTP 200. The moderator can then download the resulting CSV file containing admin-only report data. (GitHub Commit, GitHub Advisory)

• Network: Unexpected POST requests to /export_csv/export_entity.json from moderator accounts, particularly with entity=report and args[name] values corresponding to known admin-only reports (e.g., top_uploads).
• Logs: Discourse application logs showing Jobs::ExportCsvFile jobs queued by moderator user IDs for report entities that should be admin-restricted; HTTP 200 responses to export requests from non-admin users for restricted report names.
• File System: Presence of CSV export files in the Discourse exports directory corresponding to admin-only reports, attributed to moderator user accounts.

Discourse has released patched versions 2026.1.3, 2026.2.2, and 2026.3.0, which enforce proper authorization checks on the CSV export endpoint for report entities. The official workaround is to upgrade to the latest patched version immediately. No configuration-based workaround is available; upgrading is the only remediation (GitHub Advisory, GitHub Commit).