CVE-2026-72732: Discourse Information Disclosure Flaw

CVE-2026-72732 Overview

CVE-2026-72732 is a missing authorization vulnerability [CWE-862] in Discourse, an open-source discussion platform. The discourse_templates endpoint exposes hidden tag names to authenticated users who lack permission to view them. The DiscourseTemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian, bypassing tag group permission checks. Affected deployments include versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Critical Impact
Authenticated users can enumerate hidden tag names on a Discourse instance, disclosing information intended to be restricted by tag group permissions.

Affected Products

Discourse versions prior to 2026.1.6
Discourse versions prior to 2026.5.2
Discourse versions prior to 2026.6.1 and 2026.7.0

Discovery Timeline

2026-08-10 - CVE-2026-72732 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72732

Vulnerability Analysis

The vulnerability resides in the templates serializer used by the Discourse Templates plugin. The tags method returned every tag name attached to a template object without consulting the requesting user's Guardian scope. Discourse uses the Guardian pattern to enforce permission checks across the application, including tag group visibility restrictions.

Because the serializer bypassed this pattern, tags placed in restricted tag groups leaked to any authenticated user who could reach the discourse_templates endpoint. The disclosure is limited to tag names but can reveal internal taxonomy, project codenames, or moderation categories that administrators intended to hide.

Root Cause

The root cause is missing authorization enforcement in the serialization layer. The tags method called object.tags.map(&:name).sort directly against the model without applying a permission filter. Discourse provides a visible_tags helper that accepts a Guardian instance and filters based on tag group permissions, but the serializer did not use it.

Attack Vector

An authenticated low-privilege user issues a request to the templates endpoint and parses the returned JSON. The response includes tag names that would otherwise be hidden by tag group restrictions. No user interaction beyond a standard API request is required.

ruby

    end

    def tags
-      object.tags.map(&:name).sort
+      object.visible_tags(scope || Guardian.new).map(&:name).sort
    end

    def usages

Source: GitHub Commit 25e9d55

The patch replaces the unfiltered tag enumeration with a call to object.visible_tags(scope || Guardian.new), which respects tag group permissions for the current request scope.

Detection Methods for CVE-2026-72732

Indicators of Compromise

Repeated authenticated GET requests to the discourse_templates endpoint from a single user session
Response payloads from /discourse_templates containing tag names that match restricted tag groups
Unusual volume of template listing requests from non-staff accounts

Detection Strategies

Review Discourse application logs for access to the discourse_templates endpoint by users without staff or elevated permissions
Compare tag names returned in template API responses against the list of tags in restricted tag groups
Baseline normal template endpoint usage patterns and alert on deviations by low-privilege accounts

Monitoring Recommendations

Enable request logging for the Discourse Templates plugin routes and forward logs to a centralized analytics platform
Track authenticated API call rates per user and flag accounts issuing bulk template queries
Audit tag group membership changes and correlate with template endpoint access

How to Mitigate CVE-2026-72732

Immediate Actions Required

Upgrade Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 depending on your current release branch
Review tag group permissions to confirm the sensitivity of any tags that may have been exposed prior to patching
Rotate or rename tags whose disclosure could aid further reconnaissance

Patch Information

The fix is available in Discourse 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The patch updates templates_serializer.rb to call object.visible_tags(scope || Guardian.new) so that tag group permissions are enforced during serialization. See the GitHub Security Advisory GHSA-xrgc-52m8-82hm and the fix commits 25e9d55, c9b431b, f216f25, and f41e71b.

Workarounds

Disable the Discourse Templates plugin until the upgrade can be applied
Restrict access to the templates endpoint through reverse proxy rules that limit it to staff accounts
Remove sensitive tags from templates and reassign them once the patched version is in production

bash

# Verify installed Discourse version after upgrade
cd /var/discourse
./launcher enter app
cat /var/www/discourse/config/version.rb | grep -i version