CVE-2026-33410: 
NixOS vulnerability analysis and mitigation

CVE-2026-33410 is an Incorrect Authorization vulnerability (CWE-863) in Discourse, an open-source discussion platform, affecting its chat direct message (DM) API. Two distinct authorization flaws exist: a group visibility bypass and a chat-disabled user bypass. Affected versions include all releases from 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0 (before latest.1). The vulnerability was published on March 19, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat CVE).

The vulnerability stems from two distinct authorization failures in the Discourse chat DM API (CWE-863: Incorrect Authorization). First, the target_groups parameter used when creating or expanding a DM channel was passed directly to the user resolution query without validating group or member visibility for the requesting user, enabling enumeration of private/hidden group members. Second, the can_chat? authorization check only verified group membership and did not validate the chat_enabled user preference, allowing users with chat disabled to create or query DM channels between arbitrary users and read serialized last_message content from the channel response. Both issues are exploitable over the network by any authenticated user with low privileges and require no user interaction (GitHub Advisory).

Successful exploitation allows authenticated attackers to leak the identities of members belonging to private or hidden groups by crafting API requests with known group names. Additionally, users with chat disabled can bypass access controls to create or query DM channels between other users, potentially exposing private last_message content from serialized channel responses. The impact is limited to confidentiality and integrity (no availability impact), but the privacy violations could expose sensitive communications and user identity information within the Discourse platform (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.025%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authentication (low privileges) but no user interaction, making it relatively straightforward for any authenticated Discourse user to attempt.

1. Authentication: Log in to a vulnerable Discourse instance as any authenticated chat user.
2. Group visibility bypass: Craft an API request to the chat DM channel creation endpoint (e.g., POST /chat/api/direct-messages) and include a target_groups parameter set to the name of a known private or hidden group.
3. Enumerate group members: The server resolves the group's members without checking visibility permissions, returning a DM channel populated with those members — leaking their identities to the attacker.
4. Chat-disabled user bypass: Using an account with the chat_enabled preference set to disabled, craft an API request to create or query a DM channel between two other users via the direct messages API.
5. Extract private message content: Parse the serialized channel response to extract last_message content, exposing private communications between targeted users (GitHub Advisory).

• Logs: Discourse application logs showing authenticated API requests to chat DM endpoints (e.g., POST /chat/api/direct-messages) containing target_groups parameters referencing private or hidden group names.
• Logs: API activity from user accounts with chat_enabled set to false making requests to DM channel creation or query endpoints.
• Network: Unusual volume of DM channel creation API calls from a single authenticated user, particularly with varying target_groups values suggesting enumeration attempts.
• Application: Unexpected DM channels appearing in the system involving users who should not have chat access, or channels containing members of private groups not normally visible to the requesting user.

Discourse has released patched versions that address both authorization issues: 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. Administrators should upgrade to one of these versions immediately. No configuration-based workarounds are available. As an interim measure, administrators should review audit logs for suspicious DM API activity, particularly requests containing target_groups parameters or originating from chat-disabled accounts, and consider restricting API access where feasible pending patching (GitHub Advisory).