CVE-2026-72723: Discourse Information Disclosure Flaw

CVE-2026-72723 Overview

CVE-2026-72723 is an information disclosure vulnerability in Discourse, an open-source discussion platform. The flaw resides in SiteSerializer.anonymous_default_navigation_menu_tags, which serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for anonymous viewers. Unauthenticated users can retrieve restricted tag names and descriptions through the /site.json endpoint. This exposes tags that should be limited by inaccessible categories, category tag groups, or tag-group permissions. The issue is classified as a missing authorization weakness [CWE-862] and is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Critical Impact
An unauthenticated attacker can enumerate restricted tag names and descriptions over the network by querying /site.json, leaking metadata about private categories and tag groups.

Affected Products

Discourse versions prior to 2026.1.6
Discourse versions prior to 2026.5.2
Discourse versions prior to 2026.6.1 and 2026.7.0

Discovery Timeline

2026-08-10 - CVE-2026-72723 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72723

Vulnerability Analysis

The vulnerability is an information disclosure flaw in Discourse's site serializer. The anonymous_default_navigation_menu_tags method builds the default sidebar tag list for anonymous users by taking the raw list from SiteSetting.default_navigation_menu_tags and subtracting only DiscourseTagging.hidden_tag_names(scope). This filter removes tags marked as hidden but does not enforce category-based or tag-group visibility rules. As a result, tag names and their descriptions are returned in /site.json even when the tags are gated behind restricted categories or permission-controlled tag groups.

Root Cause

The root cause is missing authorization enforcement during serialization. The original code path lacked a call to DiscourseTagging.filter_visible, which applies the full visibility scope including category restrictions and tag-group permissions. Because /site.json is served to anonymous users, any tag configured as part of the default navigation menu was serialized regardless of its access controls.

Attack Vector

An unauthenticated attacker sends a network request to /site.json on a vulnerable Discourse instance. The response body contains the serialized default navigation menu tags, including restricted tag names and descriptions. No authentication, user interaction, or elevated privileges are required to trigger the disclosure.

ruby

# Patched code in app/serializers/site_serializer.rb
def anonymous_default_navigation_menu_tags
  @anonymous_default_navigation_menu_tags ||=
    begin
      tags = Tag.where(name: SiteSetting.default_navigation_menu_tags.split("|"))
      tags = DiscourseTagging.filter_visible(tags, scope)

      serialize_tags(tags.order(:name))
    end
end

Source: GitHub Commit 0248e9c

The patch replaces the naive subtraction of hidden_tag_names with a proper DiscourseTagging.filter_visible(tags, scope) call. This ensures the anonymous scope is honored and restricted tags are omitted from the serialized output.

Detection Methods for CVE-2026-72723

Indicators of Compromise

Unauthenticated HTTP GET requests to /site.json from external or unexpected IP addresses.
Repeated or scripted access patterns to /site.json indicating enumeration of sidebar tag metadata.
Reconnaissance activity referencing tag names that should only be visible to authenticated members of restricted categories.

Detection Strategies

Review Discourse and reverse proxy access logs for anonymous requests to /site.json, correlating volume and source IPs.
Compare the Discourse instance version reported in the admin dashboard against fixed versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Audit SiteSetting.default_navigation_menu_tags for tags that overlap with restricted categories or permission-scoped tag groups.

Monitoring Recommendations

Ingest web server and application logs into a centralized analytics platform to baseline normal /site.json traffic.
Alert on spikes in anonymous requests to serializer endpoints or on requests originating from anonymization services.
Track administrative changes to default_navigation_menu_tags and tag group permissions to detect misconfiguration drift.

How to Mitigate CVE-2026-72723

Immediate Actions Required

Upgrade Discourse to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 on the appropriate release branch.
Review the default_navigation_menu_tags site setting and remove any tags that belong to restricted categories or tag groups until the patch is applied.
Rotate or refresh any tag names that were considered confidential and may have been exposed through /site.json.

Patch Information

The fix is implemented across four backport pull requests: PR 42091, PR 42092, PR 42093, and PR 42094. Full technical detail is available in the GitHub Security Advisory GHSA-4p6q-h74v-5j7p. The corrective commits are 0248e9c, 03444dd, 900f51c, and da84c67.

Workarounds

Remove restricted or sensitive tags from SiteSetting.default_navigation_menu_tags until upgrading to a fixed version.
Restrict anonymous access to the Discourse instance at the reverse proxy or WAF layer if the community is not intended to be public.
Rename affected tags to non-descriptive values to reduce the value of any information leaked before patching.

bash

# Example: verify installed Discourse version before and after upgrade
cd /var/discourse
./launcher rebuild app
docker exec -it app rails runner 'puts Discourse::VERSION::STRING'