CVE-2026-33408: 
NixOS vulnerability analysis and mitigation

CVE-2026-33408 is an improper authorization vulnerability in Discourse, an open-source discussion platform, that allowed moderators to view the first 40 characters of post edits in private messages (PMs) and private categories via the "Post Edits" admin report. Disclosed on March 19, 2026, it affects Discourse versions 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0 (latest). Patched versions 2026.1.2, 2026.2.1, and 2026.3.0-latest.1 resolve the issue. It carries a CVSS v3.1 base score of 2.2–2.7 (Low) (GitHub Advisory, Feedly).

The root cause is a missing authorization check (CWE-862) in the report_post_edits method within app/models/concerns/reports/post_edits.rb. The Post Edits admin report (/admin/reports/post_edits) did not filter out private messages or secure category posts based on the requesting user's privilege level — it failed to pass the current_user context into the report query, so no access control was applied to the SQL query results. The fix adds a conditional check: unless the current user is an admin, the query now excludes topics with the private_message archetype and applies secure_category filtering via the Guardian authorization layer (GitHub Commit, GitHub Advisory).

Exploitation allows a moderator with elevated (but not admin-level) privileges to read the first 40 characters of raw post content from private messages and secure categories they should not have access to, constituting an unintended confidentiality breach. The impact is limited to partial content exposure — no integrity or availability impact exists — and does not enable lateral movement or code execution. Sensitive information such as the beginning of private communications between users could be inadvertently disclosed to moderators (GitHub Advisory, Feedly).

No public proof-of-concept exploit exists, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires the attacker to already hold moderator-level privileges on the Discourse instance, significantly limiting the attack surface. The EPSS score is approximately 0.024% (0.000240), reflecting a very low probability of exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Obtain Moderator Access: The attacker must already have or acquire moderator-level credentials on the target Discourse instance (e.g., through social engineering, credential theft, or legitimate promotion).
2. Navigate to the Post Edits Report: Access the admin report endpoint at /admin/reports/post_edits while authenticated as a moderator.
3. View Leaked Content: The report displays post edit history including the first 40 characters of raw post content. On unpatched versions, this includes edits from private messages and secure categories that the moderator should not be able to access.
4. Extract Sensitive Information: Review the report output to collect partial content from restricted PMs or private category posts, potentially revealing sensitive user communications (GitHub Advisory, GitHub Commit).

• Logs: Discourse application logs showing moderator-level accounts (non-admin) accessing /admin/reports/post_edits repeatedly or at unusual times, particularly when the instance hosts sensitive private categories or active PM usage.
• Access Patterns: Audit logs reflecting moderator accounts querying the post edits report endpoint with filters targeting specific users or time ranges, which may indicate deliberate data harvesting.

Upgrade Discourse to one of the patched versions: 2026.1.2 (for the 2026.1 branch), 2026.2.1 (for the 2026.2 branch), or 2026.3.0-latest.1 (for the latest branch). No configuration-based workarounds are available — patching is the only remediation. Administrators should prioritize upgrading instances where moderators have access to the admin panel and where sensitive discussions occur in private categories or PMs (GitHub Advisory).