NIXPKGS-2026-0901

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-33074

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 2 weeks ago
@LeSuisse deleted maintainer @talyz 5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions

https://github.com/discourse/discourse/security/advisories/GHSA-9vg5-mp49-xghh x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/c34f2aac8dcd1ae2886fa84256f607bc003f9d80 x_refsource_MISC

discourse

==>= 2026.1.0-latest, < 2026.1.3
==>= 2026.2.0-latest, < 2026.2.2
==>= 2026.3.0-latest, < 2026.3.0

https://github.com/discourse/discourse/security/advisories/GHSA-9vg5-mp49-xghh

NIXPKGS-2026-0900

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-33415

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 2 weeks ago
@LeSuisse deleted maintainer @talyz 5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure

https://github.com/discourse/discourse/security/advisories/GHSA-vj5f-gg8m-93xg x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/e1bb146a1fadc863a516fbc26c6277273a025308 x_refsource_MISC

discourse

==>= 2026.2.0-latest, < 2026.2.2
==>= 2026.1.0-latest, < 2026.1.3
==>= 2026.3.0-latest, < 2026.3.0

https://github.com/discourse/discourse/security/advisories/GHSA-vj5f-gg8m-93xg

NIXPKGS-2026-0899

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-32607

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Discourse: Stored XSS via unescaped assignee name

https://github.com/discourse/discourse/security/advisories/GHSA-xg68-q7ff-6gqm x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/46edb174e237c6e57bda9c494160da0a174fe70d x_refsource_MISC

discourse

==>= 2026.2.0-latest, < 2026.2.2
==>= 2026.1.0-latest, < 2026.1.3
==>= 2026.3.0-latest, < 2026.3.0

https://github.com/discourse/discourse/security/advisories/GHSA-xg68-q7ff-6gqm

NIXPKGS-2026-0898

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-33073

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 2 weeks ago
@LeSuisse deleted maintainer @talyz 5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

discourse-subscriptions plugin leaking stripe API key in multisite environment

https://github.com/discourse/discourse/security/advisories/GHSA-f866-8fcp-fgvv x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/c34f2aac8dcd1ae2886fa84256f607bc003f9d80 x_refsource_MISC

discourse

==>= 2026.2.0-latest, < 2026.2.2
==>= 2026.1.0-latest, < 2026.1.3
==>= 2026.3.0-latest, < 2026.3.0

https://github.com/discourse/discourse/security/advisories/GHSA-f866-8fcp-fgvv

NIXPKGS-2026-0897

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-32618

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 2 weeks ago
@LeSuisse deleted maintainer @talyz 5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Discourse: Unauthorized channel membership inference via excluded_memberships_channel_id

https://github.com/discourse/discourse/security/advisories/GHSA-pc8p-w2m7-hgf3 x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/81fd89e744058e509412158e5e6ac90c856ade64 x_refsource_MISC

discourse

==>= 2026.2.0-latest, < 2026.2.2
==>= 2026.1.0-latest, < 2026.1.3
==>= 2026.3.0-latest, < 2026.3.0

https://github.com/discourse/discourse/security/advisories/GHSA-pc8p-w2m7-hgf3

NIXPKGS-2026-0896

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-32619

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 2 weeks ago
@LeSuisse deleted maintainer @talyz 5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Discourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories

https://github.com/discourse/discourse/security/advisories/GHSA-wq58-pvf6-w4p8 x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/d74ff25db994f06aa27e3466684f613b4e986ba6 x_refsource_MISC

discourse

==>= 2026.2.0-latest, < 2026.2.2
==>= 2026.1.0-latest, < 2026.1.3
==>= 2026.3.0-latest, < 2026.3.0

https://github.com/discourse/discourse/security/advisories/GHSA-wq58-pvf6-w4p8

NIXPKGS-2026-0895

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-32143

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Discourse: Admin-only report can be exported by moderators

https://github.com/discourse/discourse/security/advisories/GHSA-rhjf-mgqw-37wq x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/727029a2983a14b50bce19439fbf9840db8372aa x_refsource_MISC

discourse

==>= 2026.2.0-latest, < 2026.2.2
==>= 2026.1.0-latest, < 2026.1.3
==>= 2026.3.0-latest, < 2026.3.0

https://github.com/discourse/discourse/security/advisories/GHSA-rhjf-mgqw-37wq

NIXPKGS-2026-0894

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-32951

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Discourse: Authorization bypass in oneboxer via user-controlled category id

https://github.com/discourse/discourse/security/advisories/GHSA-v93g-8f4f-4rgm x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/0b4e6ff170362823d1cfe2a1a096785d0d77ee83 x_refsource_MISC

discourse

==>= 2026.2.0-latest, < 2026.2.2
==>= 2026.1.0-latest, < 2026.1.3
==>= 2026.3.0-latest, < 2026.3.0

https://github.com/discourse/discourse/security/advisories/GHSA-v93g-8f4f-4rgm

NIXPKGS-2026-0892

GitHub issue published 5 months, 2 weeks ago

          Permalink
          
            CVE-2026-32113
          
              updated
            
          5 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              ignored
            
                5 packages
                discourse-mail-receiver
python312Packages.pydiscourse
python313Packages.pydiscourse
python314Packages.pydiscourse
grafanaPlugins.grafana-discourse-datasource

          5 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 2 weeks ago
          
            Discourse: Open redirect via `sso_destination_url` cookie in `enter`
          
      https://github.com/discourse/discourse/security/advisories/GHSA-378j-ccw4-4fwh
    
    x_refsource_CONFIRM
  
      https://github.com/discourse/discourse/commit/080408b93d00305b51d71f63f755f43fa601884d
    
    x_refsource_MISC
  
      https://meta.discourse.org/t/using-discourse-as-a-sso-provider/32974
    
    x_refsource_MISC
  
    discourse

            ==>= 2026.2.0-latest, < 2026.2.2
          
            ==>= 2026.1.0-latest, < 2026.1.3
          
            ==>= 2026.3.0-latest, < 2026.3.0
          
            https://github.com/discourse/discourse/security/advisories/GHSA-378j-ccw4-4fwh

NIXPKGS-2026-0893

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-32615

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Discourse: Category group moderators can perform actions on topics in restricted categories without read access

https://github.com/discourse/discourse/security/advisories/GHSA-pr9m-5hpq-wc57 x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/5a00b47523ec70cbb6e8efc3ac7677cc0a91448b x_refsource_MISC

discourse

==>= 2026.1.0-latest, < 2026.1.3
==>= 2026.2.0-latest, < 2026.2.2
==>= 2026.3.0-latest, < 2026.3.0

https://github.com/discourse/discourse/security/advisories/GHSA-pr9m-5hpq-wc57

Nixpkgs security tracker

Published issues

Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions

Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure

Discourse: Stored XSS via unescaped assignee name

discourse-subscriptions plugin leaking stripe API key in multisite environment

Discourse: Unauthorized channel membership inference via excluded_memberships_channel_id

Discourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories

Discourse: Admin-only report can be exported by moderators

Discourse: Authorization bypass in oneboxer via user-controlled category id

Discourse: Open redirect via `sso_destination_url` cookie in `enter`

Discourse: Category group moderators can perform actions on topics in restricted categories without read access