Executive brief
Discourse is an open-source platform used for hosting online discussion forums and communities. A vulnerability in the way the platform handles category data allows unauthorized or anonymous users to see the names of restricted tags and tag groups that should only be visible to specific users, such as staff or administrators. While this does not grant access to the private discussions themselves, it can leak sensitive internal terminology or organizational structures to the public.
Technical details
An information disclosure vulnerability exists in Discourse due to improper data sanitization in category serializers. When restricted tags or tag groups (intended for specific groups like staff or admins) are configured as 'allowed_tags', 'allowed_tag_groups', or 'required tag groups' on a publicly readable category, their names are included in the API responses for category and group endpoints. This allows unauthenticated remote attackers to discover the existence and names of private tags by querying these public endpoints. The issue is resolved in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Affected products
- Discourse Discourse < 2026.1.5, 2026.4.0 to 2026.4.2, 2026.5.0 to 2026.5.1, 2026.6.0
Timeline
- 2026-06-30: patched: Patched versions released and GitHub advisory published.
- 2026-07-09: disclosed: CVE published to NVD.
References
- https://github.com/discourse/discourse/releases/tag/v2026.1.5
- https://github.com/discourse/discourse/releases/tag/v2026.4.2
- https://github.com/discourse/discourse/releases/tag/v2026.5.1
- https://github.com/discourse/discourse/releases/tag/v2026.6.0
- https://github.com/discourse/discourse/security/advisories/GHSA-mwp7-572g-6qpx