CVE-2026-47264 Overview
CVE-2026-47264 is an information disclosure vulnerability in Discourse, an open-source discussion platform. The flaw exists in the DetailedTagSerializer#tag_group_names method, which returned every tag group a tag belonged to without filtering against the requesting user's visibility. When SiteSetting.tags_listed_by_group is enabled, anonymous and unprivileged users can query TagsController#info (exempt from requires_login) to read names of tag groups restricted to specific user groups or non-visible categories. The vulnerability is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Anonymous attackers can enumerate restricted tag group names over the network without authentication, exposing organizational structure metadata that should remain hidden from unprivileged users.
Affected Products
- Discourse versions 2026.1.0-latest through versions before 2026.1.4
- Discourse versions 2026.3.0-latest through versions before 2026.3.1
- Discourse versions 2026.4.0-latest through versions before 2026.4.1
Discovery Timeline
- 2026-06-12 - CVE-2026-47264 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-47264
Vulnerability Analysis
The vulnerability resides in Discourse's tag serialization logic. The DetailedTagSerializer#tag_group_names method returned the complete list of tag groups associated with a given tag. The serializer did not apply visibility filtering based on the requesting user's group memberships or category access rights.
Discourse exposes the TagsController#info endpoint without authentication requirements because it is explicitly exempted from the requires_login filter. When administrators enable SiteSetting.tags_listed_by_group, the response payload includes tag group names sourced from the unfiltered serializer output. Anonymous HTTP requests to the endpoint therefore receive metadata about tag groups that are restricted to specific user groups or tied to hidden categories.
The disclosed information can reveal internal team names, project codenames, and organizational structure. Attackers can use this metadata to plan further reconnaissance or social engineering campaigns against the forum.
Root Cause
The root cause is missing authorization checks in the serializer layer. DetailedTagSerializer#tag_group_names enumerates associated tag groups directly from the database relationship without consulting the current user context. Visibility rules enforced elsewhere in Discourse for tag groups and categories are not applied to this serialized field.
Attack Vector
The vulnerability is exploited remotely over the network. An unauthenticated attacker sends an HTTP GET request to the TagsController#info endpoint on a target Discourse instance where tags_listed_by_group is enabled. The JSON response contains the names of every tag group associated with the queried tag, including those restricted to private user groups or non-visible categories. No user interaction or elevated privileges are required.
Detection Methods for CVE-2026-47264
Indicators of Compromise
- Anonymous or unauthenticated HTTP requests to /tags/<tag_name>/info.json or related TagsController#info routes from external IP addresses
- Repeated enumeration patterns targeting multiple tag names from the same client
- Unusual web access log entries containing tag info endpoint paths originating from automated scanners or scripted user agents
Detection Strategies
- Review Discourse web server access logs for unauthenticated requests to tag info endpoints, particularly when tags_listed_by_group is enabled
- Correlate response sizes for TagsController#info requests, since responses containing restricted tag group names will be larger than expected for unprivileged users
- Inspect application logs for unusual rates of tag info requests that may indicate scripted enumeration
Monitoring Recommendations
- Deploy web application firewall (WAF) rules to alert on bulk access to tag info endpoints from a single source
- Forward Discourse access logs to a centralized logging platform for anomaly detection on tag enumeration patterns
- Monitor for changes to SiteSetting.tags_listed_by_group configuration that may expand the exposure surface
How to Mitigate CVE-2026-47264
Immediate Actions Required
- Upgrade Discourse to a patched release: 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1
- Audit the value of SiteSetting.tags_listed_by_group and disable it if not strictly required
- Review tag group names that were exposed through the endpoint and consider renaming groups that contain sensitive information
Patch Information
The Discourse maintainers released fixes in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1. The patch updates DetailedTagSerializer#tag_group_names to filter tag groups against the requesting user's visibility rules before returning the list. Refer to the GitHub Security Advisory GHSA-4q5q-6hh6-53x2 for technical details.
Workarounds
- Disable SiteSetting.tags_listed_by_group until patches can be applied, which prevents the serializer from including tag group names in the public response
- Restrict access to the TagsController#info endpoint at the reverse proxy or WAF layer to authenticated sessions only
- Avoid using sensitive identifiers as tag group names while operating an unpatched instance
# Configuration example: disable the affected site setting via Discourse rails console
cd /var/discourse
./launcher enter app
rails c
SiteSetting.tags_listed_by_group = false
exit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
