NIXPKGS-2026-0897

GitHub issue published on

Permalink CVE-2026-32618

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 1 month, 3 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 3 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
1 month, 3 weeks ago
@LeSuisse deleted maintainer @talyz 1 month, 3 weeks ago maintainer.delete
@LeSuisse accepted 1 month, 3 weeks ago
@LeSuisse published on GitHub 1 month, 3 weeks ago

Discourse: Unauthorized channel membership inference via excluded_memberships_channel_id

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, there is possible channel membership inference from chat user search without authorization. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

References

https://github.com/discourse/discourse/security/advisories/GHSA-pc8p-w2m7-hgf3 x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/81fd89e744058e509412158e5e6ac90c856ade64 x_refsource_MISC

Affected products

discourse

==>= 2026.1.0-latest, < 2026.1.3
==>= 2026.2.0-latest, < 2026.2.2
==>= 2026.3.0-latest, < 2026.3.0

Matching in nixpkgs

pkgs.discourse

Discourse is an open source discussion platform

nixos-unstable 2026.1.2
- nixpkgs-unstable 2026.1.2
- nixos-unstable-small 2026.1.2
nixos-25.11 2026.1.2
- nixos-25.11-small 2026.1.2
- nixpkgs-25.11-darwin 2026.1.2

pkgs.discourseAllPlugins

Discourse is an open source discussion platform

nixos-unstable 2026.1.2
- nixpkgs-unstable 2026.1.2
- nixos-unstable-small 2026.1.2
nixos-25.11 2026.1.2
- nixos-25.11-small 2026.1.2
- nixpkgs-25.11-darwin 2026.1.2

Ignored packages (5)

pkgs.discourse-mail-receiver

Helper program which receives incoming mail for Discourse

nixos-unstable 4.1.0
- nixpkgs-unstable 4.1.0
- nixos-unstable-small 4.1.0
nixos-25.11 4.1.0
- nixos-25.11-small 4.1.0
- nixpkgs-25.11-darwin 4.1.0

pkgs.python312Packages.pydiscourse

Python library for working with Discourse

nixos-25.11 1.7.0
- nixos-25.11-small 1.7.0
- nixpkgs-25.11-darwin 1.7.0

pkgs.python313Packages.pydiscourse

Python library for working with Discourse

nixos-unstable 1.7.0
- nixpkgs-unstable 1.7.0
- nixos-unstable-small 1.7.0
nixos-25.11 1.7.0
- nixos-25.11-small 1.7.0
- nixpkgs-25.11-darwin 1.7.0

pkgs.python314Packages.pydiscourse

Python library for working with Discourse

nixos-unstable 1.7.0
- nixpkgs-unstable 1.7.0
- nixos-unstable-small 1.7.0

pkgs.grafanaPlugins.grafana-discourse-datasource

Allows users to search and view topics, posts, users, tags, categories, and reports on a given Discourse forum through Grafana

nixos-unstable 2.0.2
- nixpkgs-unstable 2.0.2
- nixos-unstable-small 2.0.2
nixos-25.11 2.0.2
- nixos-25.11-small 2.0.2
- nixpkgs-25.11-darwin 2.0.2

Package maintainers

Ignored maintainers (1)

@talyz Kim Lindberger <kim.lindberger@gmail.com>

https://github.com/discourse/discourse/security/advisories/GHSA-pc8p-w2m7-hgf3

Nixpkgs security tracker

Details of issue NIXPKGS-2026-0897

References

Affected products

Matching in nixpkgs

pkgs.discourse

pkgs.discourseAllPlugins

pkgs.discourse-mail-receiver

pkgs.python312Packages.pydiscourse

pkgs.python313Packages.pydiscourse

pkgs.python314Packages.pydiscourse

pkgs.grafanaPlugins.grafana-discourse-datasource

Package maintainers