CVE-2026-33425: 
NixOS vulnerability analysis and mitigation

CVE-2026-33425 is an information disclosure vulnerability in Discourse, the open-source discussion platform, that allows unauthenticated users to infer private group membership by observing changes in user directory results when manipulating the exclude_groups parameter. The vulnerability was published on March 21, 2026, and affects Discourse versions 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0-latest prior to the patch. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Feedly).

The root cause is an observable discrepancy (CWE-203) in the user directory API, compounded by missing authorization checks (CWE-862) and authorization bypass through a user-controlled key (CWE-639). When an unauthenticated user supplies a private group name via the exclude_groups parameter in directory queries, the platform's response changes in a detectable way — effectively leaking whether the targeted user belongs to that private group. No authentication or special privileges are required, and exploitation requires only network access and knowledge of a username and group name to probe (GitHub Advisory).

Successful exploitation allows unauthenticated remote attackers to enumerate private group memberships and potentially infer the existence of private groups on a Discourse instance. The confidentiality impact is limited — no message content, credentials, or sensitive data are directly exposed — but the disclosure of group membership can facilitate targeted social engineering, deanonymization of users in sensitive communities (e.g., support groups, internal company forums), or reconnaissance for further attacks. There is no integrity or availability impact (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.05%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack is trivially executable by any unauthenticated user with network access to a vulnerable Discourse instance, requiring only standard HTTP requests (Feedly, GitHub Advisory).

1. Reconnaissance: Identify a publicly accessible Discourse instance running a vulnerable version (2026.1.0–2026.1.1, 2026.2.0, or 2026.3.0-latest prior to patch). Enumerate known usernames via public profiles or forum posts.
2. Baseline directory query: Send an unauthenticated HTTP GET request to the Discourse user directory endpoint (e.g., /directory_items.json) without any exclude_groups parameter and record the result set for a target user.
3. Probe with private group name: Repeat the directory query, this time appending the exclude_groups parameter with a suspected private group name (e.g., /directory_items.json?exclude_groups=secret-group).
4. Observe discrepancy: Compare the two responses. If the target user disappears from or changes position in the directory results when the group is specified, this confirms the user is a member of that private group.
5. Enumerate groups: Repeat step 3–4 with different group names to map private group memberships for targeted users, building a profile for further social engineering or targeted attacks (GitHub Advisory).

• Network: Repeated unauthenticated HTTP GET requests to /directory_items.json or similar directory endpoints with varying exclude_groups parameter values, especially cycling through multiple group names in rapid succession.
• Logs: Web server or application access logs showing high volumes of directory API requests from a single IP address or user agent with different exclude_groups values targeting specific usernames.
• Logs: Requests to the user directory endpoint from unauthenticated sessions (no session cookie or auth token) at an unusually high rate, potentially indicating automated enumeration scripts.

Discourse has released patched versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, which contain a fix for this vulnerability. Administrators who cannot immediately upgrade should apply the available workaround: disable public access to the user directory by navigating to Admin → Settings and enabling "hide user profiles from public". Upgrading to a patched version is the recommended long-term remediation (GitHub Advisory).