Executive brief
Discourse is an open-source platform used for hosting community discussion forums. A security flaw in the form templates feature allows logged-in users to view the names and technical structure of templates used in private or restricted forum categories they shouldn't be able to see. While this does not expose user posts or personal data, it reveals internal site configuration details that are intended to be hidden.
Technical details
An information disclosure vulnerability exists in Discourse due to missing authorization checks in the Form Template API. Authenticated users can bypass category-level restrictions by directly querying the `/form-templates` and `/form-templates/:id` endpoints. This allows an attacker to retrieve the name and full YAML body of templates associated with private or restricted categories they do not have permission to access. The root cause is a failure to scope template results through the 'guardian' security logic. The issue is resolved by ensuring these endpoints now use 'Category.secured(guardian)' to enforce visibility. Patches are available in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected products
- Discourse Discourse < 2026.1.4, < 2026.3.1, < 2026.4.1, < 2026.5.0-latest.1
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-05-19: disclosed: NVD publication date