CVE-2026-33428: 
NixOS vulnerability analysis and mitigation

CVE-2026-33428 is an incorrect authorization vulnerability in Discourse, an open-source discussion platform, that allows non-staff users with elevated group membership to access deleted posts belonging to any user. The flaw stems from an overly broad authorization check on the deleted posts index endpoint. Affected versions include all releases from 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0-latest prior to their respective patches. It was published on March 21, 2026, with patches released shortly after. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 4.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): the deleted posts index endpoint performs an authorization check that is too permissive, granting access to any user who holds elevated group membership rather than restricting access to staff-only users (GitHub Advisory). An attacker exploits this by authenticating as a non-staff user who belongs to an elevated group and then querying the deleted posts index endpoint, which returns deleted posts from any user on the platform. No special tools or complex techniques are required — the attack vector is network-based, requires low privileges (an authenticated account with elevated group membership), and no user interaction.

Successful exploitation allows an unauthorized non-staff user to read deleted posts from any user on the Discourse instance, resulting in a high confidentiality impact. Content that platform administrators or users intended to permanently remove — which may include sensitive discussions, private information, or moderation-related content — becomes accessible to the attacker. There is no integrity or availability impact, and lateral movement beyond the Discourse platform is not directly enabled by this vulnerability (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify a Discourse instance running a vulnerable version (2026.1.0–2026.1.1, 2026.2.0, or 2026.3.0-latest prior to patch) and obtain or register a non-staff user account that has elevated group membership on the platform.
2. Authentication: Log in to the Discourse instance with the elevated-group non-staff account to obtain a valid session token or cookie.
3. Access the deleted posts endpoint: Send an authenticated HTTP GET request to the deleted posts index endpoint (e.g., /posts/deleted or the equivalent admin/moderation endpoint) using the session credentials.
4. Retrieve deleted content: Due to the overly broad authorization check, the server returns deleted posts belonging to any user on the platform, exposing content that was intended to be inaccessible to non-staff users (GitHub Advisory).

• Network: Unusual or repeated HTTP GET requests to the deleted posts index endpoint (e.g., /posts/deleted or similar admin-scoped routes) originating from non-staff user accounts.
• Logs: Discourse application logs showing non-staff user accounts with elevated group membership accessing deleted post endpoints, particularly in high volume or at unusual times.
• Logs: Authentication logs indicating accounts with elevated group membership performing actions inconsistent with their normal usage patterns.

Discourse has released patches in versions 2026.1.2, 2026.2.1, and 2026.3.0-latest.1; users should upgrade to the appropriate patched version for their deployment track (GitHub Advisory). No configuration-based workarounds are available. As a supplementary measure, administrators should audit group membership assignments to ensure that elevated group privileges are granted only to trusted users, and monitor access logs for the deleted posts endpoint for suspicious activity.