Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-10T18:18:51.530Z",
  "pubdate": "2026-08-10T18:18:51.530Z",
  "executiveSummary": "An information disclosure vulnerability exists in the discourse_templates endpoint of the open-source discussion platform Discourse, specifically within the DiscourseTemplates::TemplatesSerializer component located at plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb.\nThe vulnerability allows unauthorized users to view hidden tag names and bypass tag group permissions enforced by the platform.\nThis affects Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.\nThe flaw exposes sensitive organizational or categorization metadata that should otherwise be restricted based on user roles and permissions.\nAn attacker can exploit this issue to enumerate hidden or restricted tags without possessing the requisite administrative or group privileges.\nRisk implications include the unauthorized leakage of sensitive discussion categorization data, potentially revealing internal project names, confidential topics, or restricted community structures.\nExploitation requires network access to the Discourse instance and interaction with the vulnerable API endpoint, without necessitating complex authentication or elevated privileges beyond standard platform access.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate access control enforcement during serialization within the discourse_templates endpoint.\nSpecifically, the component DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb fails to pass and filter tags through the request Guardian object.\nThe Guardian component in Discourse is responsible for enforcing authorization policies and permissions across models, including tag group visibility restrictions.\nBecause the serializer bypasses this validation layer, it serializes and returns tag data regardless of whether the requesting user possesses the explicit permissions required to view specific tag groups.\nThe affected component is the DiscourseTemplates::TemplatesSerializer within the discourse-templates plugin.\nAffected software versions comprise all Discourse installations running versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.\nThe attack flow proceeds as follows: an authenticated or unauthenticated user sends a request to the discourse_templates API endpoint.\nThe backend controller invokes DiscourseTemplates::TemplatesSerializer to render the template data.\nDue to the omission of the request Guardian check, the serializer queries and includes all associated tag names in the JSON response without evaluating tag group permissions.\nThe client receives the response containing restricted tag names, successfully completing the information disclosure attack.\nNetwork exposure is inherent to any publicly or internally accessible Discourse instance utilizing the vulnerable plugin.\nNo complex payload behavior or post-exploitation execution is involved, as the impact is strictly passive data exfiltration of restricted metadata."
}