Executive brief
Discourse is an open-source community discussion platform used to host forums and knowledge bases. A flaw in the Templates endpoint allows authenticated users to view hidden tag names that they are not permitted to access, potentially exposing sensitive organizational or content categorization information. This is an authorization bypass that does not require elevated privileges.
Technical details
The vulnerability is an authorization bypass in the DiscourseTemplates::TemplatesSerializer component (plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb). The serializer failed to filter tags through the request Guardian, which is Discourse's permission-checking mechanism, allowing users to view tags restricted by tag group permissions. The endpoint is network-accessible to authenticated users, and the fix involves adding proper Guardian filtering to respect tag group permissions before serializing tag data. Patches are available in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Affected products
- Discourse Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0