CVE-2026-49256: Discourse Tag Metadata Disclosure – Information Leak to Unauthorized Users

Technical summary

A broken access control vulnerability in Discourse allows unauthorized information disclosure of tag and tag-group metadata. When tags or tag groups are configured as allowed_tags, allowed_tag_groups, or required_tag_groups on publicly readable categories, their names are inappropriately exposed through category and group endpoints without proper authorization checks. An unauthenticated attacker can query these endpoints to enumerate restricted tagging schemes, revealing internal organizational metadata that should remain confidential. The vulnerability stems from insufficient access control on metadata endpoints rather than authentication bypass. The issue affects multiple Discourse release branches and is resolved in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Business impact

This vulnerability enables competitive intelligence gathering and reconnaissance. Exposed tag names and groupings often reflect internal organizational structure, workflow categories, and operational priorities—information that competitors or threat actors can weaponize for targeted social engineering or phishing campaigns. For enterprises using Discourse as an internal or semi-public collaboration platform, leaked metadata can enable privilege escalation attacks by revealing which categories require specific tag governance. The impact is information disclosure only; attackers cannot modify content, crash the service, or access restricted data beyond the tag metadata itself. However, the reputational risk is non-trivial for organizations relying on Discourse for sensitive discussions.

Affected systems

All Discourse installations prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 are affected. This includes standard deployments and self-hosted instances. The vulnerability manifests only when restricted tag configurations are applied to publicly readable categories—private or restricted categories are not affected by this leak. Organizations using Discourse with public community areas, open forums, or public-facing discussion channels while managing internal tagging schemes should prioritize assessment and patching.

Exploitability

Exploitability is high with no barriers to attack. The vulnerability requires no authentication, no user interaction, and no special network positioning—an attacker with internet access to a Discourse instance can directly query the affected endpoints to extract tag metadata. The CVSS score of 7.5 (HIGH) reflects the network-accessible nature and complete information disclosure. However, exploitation is passive reconnaissance rather than active compromise; no exploit kit, worm propagation, or widespread active exploitation is reported. The vulnerability does not appear in the CISA KEV catalog, indicating no evidence of in-the-wild weaponization at publication time, though opportunistic scanning and enumeration by threat actors is probable.

Remediation

Apply security patches immediately to all supported Discourse instances. The vendor has released fixes across multiple branches: upgrade to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 depending on your current version track. Verify compatibility with plugins and custom configurations before deploying to production. Organizations unable to patch immediately should audit which categories have restricted tags configured and consider temporarily disabling public access to those categories or removing the tag restrictions until patching is feasible.

Patch guidance

Discourse provides version-specific patches across four branches to accommodate different upgrade cadences. Determine your current Discourse version and release branch, then upgrade to the corresponding patched version: stable releases should update to 2026.6.0, and earlier branches should move to 2026.5.1, 2026.4.2, or 2026.1.5 respectively. Follow Discourse's standard update procedures to minimize downtime. Test the patch in a staging environment first, particularly if you rely heavily on tag-based category organization or have custom tag-related plugins. No database migrations or manual configuration changes are required post-patch. Verify against the official Discourse security advisory to confirm patch availability and any additional migration guidance for your deployment model.

Detection guidance

Review access logs and API query patterns for repeated requests to /categories and /groups endpoints from unauthenticated or low-privilege users, particularly queries that extract tag metadata. Baseline normal traffic to these endpoints and flag anomalous enumeration patterns. If you maintain detailed category and endpoint access logs, search for anonymous API calls containing tag-related query parameters. Scope internal discussions: review which categories are marked as public while containing restricted tags, and assess whether external users have successfully harvested tag metadata. Post-patch, monitor for continued exploitation attempts targeting the previously exposed endpoints. No specific indicator of compromise (IOC) exists for this information disclosure, but elevated enumeration activity may warrant network segmentation review.

Why prioritize this

Although this vulnerability does not appear in active exploitation or the CISA KEV list, it merits high priority due to its ease of exploitation and potential for reconnaissance leading to secondary attacks. The HIGH CVSS score and network-accessible attack vector demand rapid patching. Organizations exposing public forums, community areas, or open-access categories should patch within 30 days. Enterprises with non-public Discourse instances but containing tag schemes tied to sensitive processes should patch within 60 days. The low complexity and zero authentication requirement make this an attractive target for threat actors performing infrastructure reconnaissance; delaying patches increases exposure window.

Risk score, explained

The 7.5 CVSS score (HIGH severity) reflects a network-accessible, unauthenticated information disclosure with no user interaction required and complete availability of the leaked asset (tag metadata). The vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N correctly captures the attack profile: no authentication (PR:N), low attack complexity (AC:L), high confidentiality impact (C:H), and no integrity or availability impact (I:N/A:N). While the disclosure is limited to metadata rather than user content or credentials, the CVSS assessment appropriately weights the severity because unrestricted metadata enumeration on a remote endpoint represents a concrete, exploitable information leak that an attacker can weaponize without additional privilege escalation.

Frequently asked questions