CVE-2026-32951: 
NixOS vulnerability analysis and mitigation

CVE-2026-32951 is an authorization bypass vulnerability in Discourse, the open-source discussion platform, that allows authenticated users to obtain shared draft topic titles through a crafted inline onebox request. Affected versions span 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest (pre-release). The vulnerability was published on March 31, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Feedly).

The root cause is an incomplete authorization check (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the Oneboxer.local_topic method within lib/oneboxer.rb. When the category_id parameter in an inline onebox request matches the target topic's category ID, the code skipped the can_see_topic? check for the authenticated user, only performing an anonymous guardian check instead. An attacker can exploit this by sending a GET request to /inline-onebox.json with a urls parameter pointing to a shared draft topic URL and a category_id matching the shared drafts category, bypassing the group-based access control (shared_drafts_allowed_groups) that normally restricts visibility. The fix, applied in commit 0b4e6ff, ensures can_see_topic? is always evaluated against the current authenticated user even when category IDs match (GitHub Commit, GitHub Advisory).

Successful exploitation allows any authenticated Discourse user to enumerate the titles of shared draft topics that are restricted to privileged groups (e.g., staff). Only topic titles are disclosed — post content, body text, and other metadata are not exposed. There is no impact on integrity or availability, and the vulnerability does not enable lateral movement or privilege escalation beyond information disclosure (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid authenticated session, limiting the attack surface to registered users of affected Discourse instances (Feedly).

1. Authenticate: Log in to a target Discourse instance as any registered user (no elevated privileges required).
2. Identify the shared drafts category: Enumerate category IDs by browsing the Discourse site or querying the /categories.json API endpoint to find the category configured as shared_drafts_category.
3. Craft the malicious request: Send a GET request to /inline-onebox.json with parameters urls[] set to the URL of a suspected shared draft topic and category_id set to the shared drafts category ID (e.g., GET /inline-onebox.json?urls[]=https://forum.example.com/t/secret-draft/123&category_id=42).
4. Extract the title: Parse the JSON response — if the bypass succeeds, the title field in the inline-oneboxes array will contain the shared draft topic title that the user would not normally be permitted to see (GitHub Advisory, GitHub Commit).

• Network/Logs: Unusual or repeated GET requests to /inline-onebox.json from non-staff user accounts, particularly with a category_id parameter matching the configured shared drafts category ID.
• Logs: Discourse application logs showing authenticated requests to the inline onebox endpoint with category_id values corresponding to restricted categories, especially from accounts not in shared_drafts_allowed_groups.
• Behavioral: A pattern of requests iterating over multiple topic URLs combined with the shared drafts category_id, suggesting automated enumeration of draft topic titles (GitHub Advisory).

Discourse has released patched versions 2026.1.3, 2026.2.2, and 2026.3.0; upgrading to one of these versions is the recommended remediation. As a temporary workaround without upgrading, administrators should ensure the shared_drafts_category site setting points to a read-restricted category (e.g., staff-only). This causes the can_see_category? check to block the request before reaching the vulnerable code path, preventing title disclosure (GitHub Advisory).