Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-0680

NIXPKGS-2026-0680
published 3 months ago
Permalink CVE-2026-33425
updated 3 months ago by @mweinelt Activity log
  • Created suggestion 3 months ago
  • @mweinelt accepted 3 months ago
  • @mweinelt ignored
    6 packages
    • discourseAllPlugins
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    3 months ago
  • @mweinelt published on GitHub 3 months ago
Discourse has inferable private group membership or existence via exclude_groups parameter

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenticated users can determine whether a specific user is a member of a private group by observing changes in directory results when using the `exclude_groups` parameter. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, disable public access to the user directory via Admin → Settings → hide user profiles from public.

Affected products

discourse
  • ==>= 2026.2.0-latest, < 2026.2.1
  • === 2026.3.0-latest
  • ==>= 2026.1.0-latest, < 2026.1.2

Matching in nixpkgs

Ignored packages (6)

Package maintainers

https://github.com/discourse/discourse/security/advisories/GHSA-r6rh-xvf5-r5f2