Nixpkgs security tracker
Activity log
- Created suggestion
Discourse: Hidden tag visibility bypass on tag routes
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass vulnerability allows unauthenticated or unauthorized users to view hidden (staff-only) tags and its associated data. All Discourse instances with tagging enabled and staff-only tag groups configured are impacted. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
References
-
https://github.com/discourse/discourse/security/advisories/GHSA-6c9x-3vrp-682x x_refsource_CONFIRM
Affected products
- ==>= 2026.3.0-latest, < 2026.3.0
- ==>= 2026.1.0-latest, < 2026.1.3
- ==>= 2026.2.0-latest, < 2026.2.2
Matching in nixpkgs
pkgs.discourse
Open source discussion platform
pkgs.discourseAllPlugins
Open source discussion platform
pkgs.discourse-mail-receiver
Helper program which receives incoming mail for Discourse
pkgs.python312Packages.pydiscourse
None
pkgs.python313Packages.pydiscourse
Python library for working with Discourse
pkgs.python314Packages.pydiscourse
Python library for working with Discourse
pkgs.grafanaPlugins.grafana-discourse-datasource
Allows users to search and view topics, posts, users, tags, categories, and reports on a given Discourse forum through Grafana
Package maintainers
-
@talyz Kim Lindberger <kim.lindberger@gmail.com>
-
@leona-ya Leona Maroni <nix@leona.is>
-
@Dettorer Paul Hervot <paul.hervot@dettorer.net>
-
@nagisa Simonas Kazlauskas <nixpkgs@kazlauskas.me>