CVE-2026-32620: 
NixOS vulnerability analysis and mitigation

CVE-2026-32620 is an information disclosure vulnerability in Discourse, the open-source discussion platform, caused by missing post-level authorization in the read receipts endpoint. Authenticated non-staff users could access read receipt metadata (who read a post and when) for staff-only "whisper" posts they were not authorized to view. No actual post content was exposed — only metadata. Affected versions span 2026.1.0-latest through before 2026.1.3, 2026.2.0-latest through before 2026.2.2, and 2026.3.0-latest (unpatched). It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is a missing authorization check (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the PostReadersController#index action. When a request was made to the /post_readers.json endpoint with a post ID, the controller retrieved the post and checked whether the requester could view reader data, but failed to first verify whether the requester could see the post itself via guardian.ensure_can_see!(post). This allowed any authenticated group member with publish_read_state enabled to query read receipt metadata for whisper (staff-only) posts by supplying the post's ID. The fix, committed in bf8dbf6, adds the missing guardian.ensure_can_see! check before the reader data is returned (GitHub Commit, GitHub Advisory).

Exploitation allows non-staff users to determine which staff members have read specific restricted (whisper) posts and the timestamps of those reads. This metadata exposure can reveal staff response patterns, internal decision-making timelines, and communication activity related to staff-only discussions. No post content, system availability, or data integrity is affected — the impact is strictly limited to confidentiality of read receipt metadata (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.042%, reflecting a low probability of exploitation in the near term. The vulnerability requires the attacker to be an authenticated, low-privileged user who is a member of a group with publish_read_state enabled, limiting the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Authenticate: Log in to a Discourse instance as a non-staff user who is a member of a group that has publish_read_state enabled.
2. Identify whisper post IDs: Enumerate or guess post IDs for whisper (staff-only) posts. Post IDs are sequential integers and may be discoverable through other API endpoints or by observing topic post counts.
3. Query the read receipts endpoint: Send an authenticated GET request to /post_readers.json?id=<whisper_post_id> targeting a known or suspected whisper post ID.
4. Collect metadata: On unpatched versions, the server returns read receipt metadata — including staff usernames and timestamps — without verifying whether the requesting user can view the post itself.
5. Analyze results: Use the returned metadata to infer which staff members have read the restricted post and when, potentially revealing internal response patterns or communication timelines (GitHub Commit, GitHub Advisory).

• Network/Logs: Repeated or automated GET requests to /post_readers.json with varying id parameters from non-staff user accounts, particularly targeting post IDs that correspond to whisper posts.
• Logs: Web server or application logs showing non-staff authenticated users successfully receiving 200 OK responses from /post_readers.json for whisper post IDs (on unpatched instances).
• Behavioral: A non-staff user account making an unusually high volume of requests to the /post_readers.json endpoint in a short time window, suggesting enumeration of post IDs.

Discourse has released patched versions addressing this vulnerability: 2026.1.3, 2026.2.2, and 2026.3.0. The only recommended remediation is upgrading to one of these patched versions; no configuration-based workaround is available. Administrators unable to patch immediately should review access logs for suspicious queries to /post_readers.json and consider restricting group membership with publish_read_state to trusted users (GitHub Advisory, GitHub Commit).