Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view.
This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
discourse:discourse
References 5
https://github.com/discourse/discourse/security/advisories/GHSA-xrgc-52m8-82hm
https://github.com/discourse/discourse/security/advisories/GHSA-xrgc-52m8-82hm
https://github.com/discourse/discourse/commit/25e9d55b4c652b8dc1c90f44c40c8f3fe…
https://github.com/discourse/discourse/commit/25e9d55b4c652b8dc1c90f44c40c8f3fec77748c
https://github.com/discourse/discourse/commit/c9b431b3b75727f7132ec231142371d20…
https://github.com/discourse/discourse/commit/c9b431b3b75727f7132ec231142371d203a6124b
https://github.com/discourse/discourse/commit/f216f258bd473e6299c6aef7b6130e7db…
https://github.com/discourse/discourse/commit/f216f258bd473e6299c6aef7b6130e7db90116c0
https://github.com/discourse/discourse/commit/f41e71b645eb60cc263e7a1de22251028…
https://github.com/discourse/discourse/commit/f41e71b645eb60cc263e7a1de22251028115abf1