CVE-2026-47264: Discourse Tag Group Name Disclosure Information Leak

Technical summary

DetailedTagSerializer in Discourse versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0 returns the complete set of tag_group_names associated with a tag without performing authorization checks. The TagsController#info endpoint, which does not require authentication, invokes this serializer. When SiteSetting.tags_listed_by_group is true, the lack of visibility-based filtering in the serialization layer allows any unauthenticated request to enumerate tag group names that should be hidden from the requesting user. This is a classic authorization bypass leading to enumeration of sensitive organizational metadata. The vulnerability is rooted in CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Business impact

This vulnerability enables information disclosure that could reveal internal organizational structure, restricted topic groupings, and private category hierarchies to unauthenticated users. While not directly enabling data modification or destruction, the exposure of tag group names—especially those tied to restricted user groups or hidden categories—can inform social engineering, targeted reconnaissance, or privilege escalation attempts. For communities relying on tag groups for access control, topic segregation, or organizational privacy, this represents a confidentiality breach that undermines the assumptions under which tag visibility policies were configured.

Affected systems

Discourse versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0 are affected when SiteSetting.tags_listed_by_group is enabled. Patched versions include 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1. Self-hosted Discourse instances with this configuration enabled are at risk; the vulnerability is exposed at the public TagsController#info endpoint and requires no authentication to exploit.

Exploitability

Exploitability is straightforward: an attacker simply sends an unauthenticated HTTP request to the TagsController#info endpoint and parses the serialized response to extract restricted tag group names. No user interaction, authentication, or special network access is required. The attack surface is wide—any instance with SiteSetting.tags_listed_by_group enabled and exposed to the internet presents this risk. However, the attack only yields tag group names and does not grant the attacker access to restricted content, user data within those groups, or the ability to modify anything. This limits impact relative to the ease of exploitation.

Remediation

Upgrade affected Discourse instances to patched versions immediately: 2026.1.4 or later for the 2026.1 branch, 2026.3.1 or later for the 2026.3 branch, 2026.4.1 or later for the 2026.4 branch, or 2026.5.0-latest.1 or later. If upgrading is not immediately feasible, disable SiteSetting.tags_listed_by_group as a temporary mitigation to prevent tag group enumeration. Verify the setting status in your Discourse admin panel under Settings > Tags.

Patch guidance

Discourse has released patches across all active version branches. Verify your current version in the Discourse admin panel (Dashboard > Version). Compare against the patched versions listed above and upgrade accordingly. The patched versions address the authorization filtering logic in DetailedTagSerializer#tag_group_names to ensure that only tag groups visible to the requesting user are returned. Standard Discourse update procedures (via the admin interface or command line, depending on deployment) should be followed. Test in a staging environment if possible before production deployment.

Detection guidance

Monitor access logs for repeated or automated requests to the /tags/info endpoint from unauthenticated sources, particularly patterns consistent with enumeration (e.g., scanning multiple tag identifiers). Audit your current Discourse version and the state of SiteSetting.tags_listed_by_group to determine exposure. If the setting is enabled and your instance is on an affected version, assume that tag group names have been accessible to unauthorized users. Review tag group definitions to assess what information was exposed and whether tag groups correlate with restricted user groups, private categories, or sensitive organizational structure.

Why prioritize this

Although the CVSS score is moderate (5.3), prioritization should account for the attack surface and business context. Any publicly accessible Discourse instance with tags_listed_by_group enabled is exploitable without authentication or user interaction. If your tag groups map to restricted user groups, private projects, or organizational hierarchies, this is a confidentiality breach worth expediting. For open, community-driven forums with minimal access controls, risk is lower but should still be addressed promptly given the ease of exploitation and patch availability.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium) reflects a network-exploitable information disclosure with no authentication required (AV:N, AC:L, PR:N), but limited scope and impact to confidentiality only (S:U, C:L, I:N, A:N). The 'Low' confidentiality impact rating in CVSS is calibrated to the exposure of tag group names rather than direct user data or content access. However, in contexts where tag groups encode sensitive organizational information, the business and reputational impact may exceed the numeric score; risk teams should adjust prioritization based on their use of tag groups and the sensitivity of their Discourse deployment.

Frequently asked questions