CVE-2026-33251: 
NixOS vulnerability analysis and mitigation

CVE-2026-33251 is an authorization bypass vulnerability in Discourse, an open-source discussion platform, affecting the handling of hidden Solved topics. The flaw allows low-privileged, authenticated users to accept or unaccept solutions in hidden topics without proper authorization. It was published on March 20, 2026, and affects Discourse versions prior to 2026.1.2 (on the 2026.1.x branch), prior to 2026.2.1 (on the 2026.2.x branch), and version 2026.3.0 prior to 2026.3.0-latest.1. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is incorrect authorization (CWE-863) in Discourse's solution acceptance functionality for hidden Solved topics, where permission checks fail to properly validate whether a user has the right to accept or unaccept a solution. An authenticated attacker with low privileges can send network requests to manipulate solution acceptance states on hidden topics that should be inaccessible to them. No user interaction is required, and the attack complexity is low, making it straightforward to exploit once an attacker has a valid account. No public proof-of-concept code has been identified (GitHub Advisory).

Successful exploitation allows unauthorized low-privileged users to accept or unaccept solutions in hidden Solved topics, undermining the integrity of the platform's knowledge organization. This can result in incorrect solution designations, unintended information disclosure (e.g., confirming the existence or content of hidden topics), and disruption of community-managed content. There is no availability impact, and the vulnerability is scoped to the affected Discourse instance without lateral movement potential (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time. The EPSS score is approximately 0.025%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

Discourse has released patches addressing this vulnerability: upgrade to version 2026.1.2 or later (for 2026.1.x branch), 2026.2.1 or later (for 2026.2.x branch), or 2026.3.0-latest.1 or later (for the latest branch). As an interim workaround prior to patching, administrators should restrict the accept_all_solutions_allowed_groups Site Setting to only include trusted users. Administrators are also advised to audit solution acceptance logs for any unauthorized modifications to hidden Solved topics (GitHub Advisory).