Executive brief
Discourse is an open-source platform used for hosting online discussion forums and communities. A security flaw allowed unauthorized or anonymous users to see the names of private tag groups that should have been restricted to specific staff or member groups. While this does not expose the content of private discussions, it reveals internal organizational structures and category names that were intended to remain hidden.
Technical details
An information disclosure vulnerability exists in Discourse due to improper visibility filtering in the DetailedTagSerializer#tag_group_names component. When the 'SiteSetting.tags_listed_by_group' setting is enabled, the TagsController#info endpoint—which does not require authentication—fails to filter tag group names based on the requesting user's permissions. As a result, unauthenticated remote attackers can discover the names of restricted tag groups or those associated with non-visible categories. The issue is resolved in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected products
- Discourse Discourse 2026.1.0-latest to 2026.1.3, 2026.3.0-latest, 2026.4.0-latest
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD