Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-0894

NIXPKGS-2026-0894
published on
Permalink CVE-2026-32951
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
updated 2 days, 13 hours ago by @LeSuisse Activity log
  • Created automatic suggestion 2 days, 17 hours ago
  • @LeSuisse removed package discourse-mail-receiver 2 days, 14 hours ago
  • @LeSuisse removed package python312Packages.pydiscourse 2 days, 14 hours ago
  • @LeSuisse removed package python313Packages.pydiscourse 2 days, 14 hours ago
  • @LeSuisse removed package python314Packages.pydiscourse 2 days, 14 hours ago
  • @LeSuisse removed package grafanaPlugins.grafana-discourse-datasource 2 days, 14 hours ago
  • @LeSuisse accepted 2 days, 14 hours ago
  • @LeSuisse published on GitHub 2 days, 13 hours ago
Discourse: Authorization bypass in oneboxer via user-controlled category id

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated user can obtain shared draft topic titles by sending an inline onebox request with a category_id parameter matching the shared drafts category. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Affected products

discourse
  • ==>= 2026.2.0-latest, < 2026.2.2
  • ==>= 2026.1.0-latest, < 2026.1.3
  • ==>= 2026.3.0-latest, < 2026.3.0

Matching in nixpkgs

Package maintainers

https://github.com/discourse/discourse/security/advisories/GHSA-v93g-8f4f-4rgm