CVE-2026-33426: 
NixOS vulnerability analysis and mitigation

CVE-2026-33426 is a missing authorization vulnerability in Discourse, an open-source discussion platform, that allows authenticated users with tag-editing permissions to edit and create synonyms for tags hidden in restricted tag groups, even without visibility into those tags. It affects Discourse versions 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0-latest (pre-patch). The vulnerability was published on March 21, 2026, and patched versions were released on March 24, 2026. It carries a CVSS v3.1 base score of 3.5–3.8 (Low) (GitHub Advisory).

The root cause is a missing authorization check (CWE-862) in Discourse's tag management logic, where the system failed to validate whether a user had visibility into a tag group before permitting tag synonym creation or editing. An authenticated attacker with tag-editing privileges can exploit this over the network by targeting the tag synonym API endpoints, bypassing the intended access control boundary enforced by restricted tag groups. No special configuration is required beyond having tag-editing permissions, and user interaction is required per the CVSS scoring. No public proof-of-concept or technical write-up beyond the vendor advisory is currently available (GitHub Advisory).

Successful exploitation allows an authenticated user to manipulate tag synonyms for restricted tags they should not be able to see or access, leading to limited information disclosure (confirming the existence of restricted tags) and integrity impact through disruption of tag organization and content categorization. The vulnerability does not affect availability and does not enable remote code execution or privilege escalation. The scope is limited to the tag management subsystem of the affected Discourse instance (GitHub Advisory).

There is no known public proof-of-concept exploit, and no evidence of in-the-wild exploitation has been reported. The vulnerability requires high privileges (tag-editing permissions) and user interaction, significantly limiting its attack surface. The EPSS score is approximately 0.019%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

Discourse has released patches addressing this vulnerability: upgrade to version 2026.1.2 or later (for the 2026.1.x branch), 2026.2.1 or later (for the 2026.2.x branch), or 2026.3.0-latest.1 or later (for the 2026.3.x branch). No configuration-based workarounds are available. As an interim measure if patching is not immediately possible, administrators should restrict tag-editing permissions to trusted administrators only and monitor tag modification activity for anomalies (GitHub Advisory).