CVE-2026-72732
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 contains a vulnerability in the discourse_templates endpoint that exposed hidden tag names. The DiscourseTemplates::TemplatesSerializer did not filter tags through the request Guardian, so it did not respect tag group permissions, allowing users to see tags they were not permitted to view.
Risk Assessment
Users can see hidden tags, potentially revealing sensitive information about categories or topics they do not have access to.
Recommendation
Upgrade Discourse to one of the patched versions: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.
Original NVD description (English source)
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.