CVE-2026-33355: 
NixOS vulnerability analysis and mitigation

CVE-2026-33355 is an information disclosure vulnerability in Discourse, an open-source discussion platform, where the /private-posts endpoint fails to apply post-type visibility filtering. This allows authenticated regular PM (private message) participants to view whisper posts — a restricted post type intended only for users with whisperer permissions — within PM topics they have legitimate access to. The vulnerability was disclosed on March 19, 2026, and affects Discourse versions 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0-latest (pre-patch). It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In app/controllers/posts_controller.rb, the latest action for the /private-posts endpoint queried Post.private_posts without applying Topic.visible_post_types(current_user) scoping, meaning all post types — including whispers — were returned regardless of the requesting user's permissions. The fix adds a single .where(post_type: Topic.visible_post_types(current_user)) filter to ensure whisper posts are only included in responses for users with whisperer-level permissions. Exploitation requires only a valid authenticated session as a PM participant — no elevated privileges are needed (GitHub Advisory, Patch Commit).

Successful exploitation results in unauthorized disclosure of confidential whisper posts within private message topics. Whisper posts in Discourse are typically used by moderators or staff to communicate sensitive information (e.g., moderation notes, internal discussions) that should not be visible to regular participants. Any authenticated user who is a participant in a PM topic can read these restricted communications, potentially exposing sensitive moderation decisions, user data, or internal platform discussions. There is no integrity or availability impact (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is straightforward to exploit manually by any authenticated PM participant simply by making a GET request to /private-posts.json. No threat actor attribution has been reported. The EPSS score is approximately 0.03%, reflecting a low probability of automated exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authenticate: Log in to a vulnerable Discourse instance (versions prior to 2026.1.2, 2026.2.1, or 2026.3.0-latest.1) as any regular user who is a participant in at least one private message topic.
2. Identify the endpoint: Navigate to or directly request GET /private-posts.json — this endpoint lists recent private posts accessible to the authenticated user.
3. Retrieve whisper posts: Because the endpoint lacks post-type filtering, the JSON response will include whisper posts (post_type: whisper) alongside regular posts in PM topics the user participates in.
4. Extract sensitive content: Parse the private_posts array in the JSON response to identify and read whisper post content, which may contain moderator notes, internal staff communications, or other restricted information (GitHub Advisory, Patch Commit).

• Network: Repeated or automated GET requests to /private-posts.json from non-administrative user accounts, particularly from accounts that are not expected to access this endpoint frequently.
• Logs: Discourse application logs showing authenticated non-whisperer users accessing /private-posts and receiving responses containing whisper post IDs; look for high-frequency polling of this endpoint from a single user account.
• Behavior: User accounts with no moderation role making requests to /private-posts.json shortly after joining a PM topic, especially if the account was recently created or has minimal activity history.

Upgrade Discourse to one of the patched versions immediately: 2026.1.2 (for the 2026.1.x branch), 2026.2.1 (for the 2026.2.x branch), or 2026.3.0-latest.1 (for the 2026.3.x branch). No configuration-based workarounds are available — patching is the only remediation. After upgrading, administrators should review access logs for the /private-posts endpoint to identify any potential unauthorized access to whisper posts during the exposure window (GitHub Advisory).