CVE-2026-72732 PUBLISHED

Discourse: Templates endpoint exposes hidden tag names

Assigner: GitHub_M
Reserved: 10.08.2026 Published: 10.08.2026 Updated: 10.08.2026

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Product Status

Vendor discourse
Product discourse
Versions
  • Version < 2026.1.6 is affected
  • Version >= 2026.5.0-latest, < 2026.5.2 is affected
  • Version >= 2026.6.0-latest, < 2026.6.1 is affected
  • Version >= 2026.7.0-latest, < 2026.7.0 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE