CVE-2026-33422: 
NixOS vulnerability analysis and mitigation

CVE-2026-33422 is an information disclosure vulnerability in Discourse, an open-source discussion platform, where the ip_address of a flagged user is improperly exposed to any user who can access the review queue — including users who should not have permission to view IP addresses. The vulnerability was published on March 20, 2026, and affects Discourse versions in the 2026.1.x branch (prior to 2026.1.2), the 2026.2.x branch (prior to 2026.2.1), and version 2026.3.0-latest (prior to 2026.3.0-latest.1). It carries a CVSS v3.1 base score of 3.5 (Low) per the GitHub Security Advisory, or 4.3 (Medium) per NVD scoring (GitHub Advisory, Feedly).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the review queue feature fails to enforce proper access controls when rendering flagged user data, causing the ip_address field to be included in responses regardless of whether the requesting user has the privilege to view IP addresses (GitHub Advisory). The attack vector is network-based, requires low privileges (access to the review queue), and low attack complexity. Exploitation requires user interaction (i.e., the attacker must navigate to the review queue), and no authentication bypass is needed beyond having review queue access (GitHub Advisory).

Successful exploitation allows a low-privileged user with review queue access to view the IP addresses of flagged users who they are not authorized to identify. This constitutes a privacy violation that could enable user tracking or geolocation of community members, potentially chilling free expression on the platform. There is no impact on integrity or availability, and no evidence of lateral movement potential beyond the information disclosure itself (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.027% (0.000270), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Gain review queue access: Obtain or use an existing low-privileged Discourse account that has been granted access to the review queue (e.g., a moderator-level or trust-level account with review permissions).
2. Navigate to the review queue: Log in to the Discourse instance and browse to the review queue interface, which lists flagged posts and users.
3. Observe exposed IP address: Inspect the review queue entries for flagged users — the ip_address field is rendered in the response even if the account does not have explicit permission to view IP addresses.
4. Extract IP address data: Read or capture the exposed IP addresses from the UI or underlying API response to identify or track flagged users (GitHub Advisory).

• Logs: Unusual or repeated access to the Discourse review queue (/review endpoint) by accounts that do not typically perform moderation tasks.
• Logs: API requests to review queue endpoints from low-trust user accounts, particularly if access patterns are inconsistent with normal moderation activity.
• Network: Automated or scripted requests to the review queue API endpoint in rapid succession, suggesting programmatic harvesting of IP address data.

Discourse has released patches addressing this vulnerability. Administrators should upgrade to one of the following versions based on their current branch: 2026.3.0-latest.1, 2026.2.1, or 2026.1.2. No configuration-based workarounds are available; upgrading is the only remediation. As a precautionary measure, administrators should also review and restrict review queue access to only those users who require it, and audit review queue access logs for any unauthorized viewing of user IP addresses (GitHub Advisory).