CVE-2026-27481
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Discourse versions from 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0 to before 2026.3.0 have an authorization bypass vulnerability. Unauthenticated or unauthorized users can view staff-only tags and associated data.
Risk Assessment
Exposure of confidential tags and data can lead to information leakage about internal content categories, violating security policy.
Recommendation
Update Discourse to versions 2026.1.3, 2026.2.2, or 2026.3.0, which include the authorization fix.
Original NVD description (English source)
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass vulnerability allows unauthenticated or unauthorized users to view hidden (staff-only) tags and its associated data. All Discourse instances with tagging enabled and staff-only tag groups configured are impacted. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.