CVE-2026-33394: 
NixOS vulnerability analysis and mitigation

CVE-2026-33394 is an information disclosure vulnerability in Discourse, the open-source discussion platform, where the Post Edits admin report (/admin/reports/post_edits) leaked the first 40 characters of raw post content from private messages and secure categories to moderators who should not have access to that content. It affects Discourse versions 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0 (latest track prior to the patch). The vulnerability was disclosed on March 19, 2026, and carries a CVSS v3.1 base score of 2.7 (Low) (GitHub Advisory).

The root cause is improper access control in the report generation logic for the Post Edits admin report, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The report_post_edits method in app/models/concerns/reports/post_edits.rb did not filter out private message topics or secure category posts based on the requesting user's permissions — it failed to pass the current_user context into the report query, so no permission-aware filtering was applied. The fix adds SQL conditions to exclude private message archetypes and apply secure_category filtering for non-admin users, and also incorporates the current user's ID into the report cache key to prevent cross-user cache leakage (GitHub Commit 3bf3793, GitHub Advisory).

Exploitation allows a moderator account — a privileged but not fully trusted role — to view the first 40 characters of raw post content from private messages and secure categories they are not authorized to access. The impact is limited to confidentiality; there is no integrity or availability effect. While only a snippet of content is exposed, this could reveal sensitive discussion topics, usernames, or partial private communications to unauthorized internal actors (GitHub Advisory, Feedly).

Exploitation requires an authenticated moderator-level account on the Discourse instance, making this an insider or privilege-abuse scenario rather than an external attack. There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is approximately 0.027%, reflecting very low likelihood of automated exploitation. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

1. Obtain moderator access: Log in to a vulnerable Discourse instance using a moderator account (not a full admin).
2. Navigate to the Post Edits report: Access the admin panel and browse to /admin/reports/post_edits.
3. View leaked content: The report displays post edit history including the first 40 characters of raw post content from private messages and secure categories, which the moderator would not normally be permitted to read.
4. Collect information: Record the exposed content snippets to gain partial insight into private conversations or restricted category discussions (GitHub Advisory).

• Logs: Web server or application access logs showing moderator accounts (non-admin users) making repeated GET requests to /admin/reports/post_edits — particularly if the moderator has no legitimate reason to review post edit history.
• Audit Trail: Discourse staff action logs showing moderator access to the Post Edits admin report at unusual times or frequencies.

Upgrade Discourse to one of the patched versions: 2026.3.0-latest.1, 2026.2.1, or 2026.1.2. No configuration-based workarounds are available. As a supplementary measure, administrators should review access logs for the /admin/reports/post_edits endpoint to identify any moderators who may have accessed restricted content prior to patching (GitHub Advisory).