CVE-2026-72723 in Discourse
Summary
by MITRE • 08/10/2026
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability affects Discourse, an open-source discussion platform, where improper access control mechanisms allow unauthorized users to discover restricted content through API endpoints. The flaw exists in the SiteSerializer class where anonymous default navigation menu tags are serialized without proper visibility filtering, creating a information disclosure issue that violates fundamental security principles of least privilege and access control. The vulnerability specifically impacts versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, indicating a persistent weakness in the platform's permission handling system that could expose sensitive metadata to unauthenticated users.
The technical implementation flaw resides in the SiteSerializer.anonymous_default_navigation_menu_tags method which fails to invoke DiscourseTagging.filter_visible before serializing tag data for anonymous viewers. This represents a classic authorization bypass vulnerability where the system assumes all users have equal access to content regardless of their authentication status or role-based permissions. The lack of proper filtering means that tags associated with restricted categories, category tag groups, or those governed by tag-group permissions are inadvertently exposed through the /site.json endpoint. This issue maps to CWE-200 (Information Exposure) and CWE-284 (Improper Access Control) while aligning with ATT&CK technique T1213.002 (Data from Information Repositories) for information gathering activities.
The operational impact of this vulnerability is significant as it allows unauthenticated attackers to gather intelligence about the platform's internal structure and content organization. An attacker could map out restricted categories, identify sensitive tag groups, and potentially discover content that should remain hidden from public view. This information disclosure could enable more sophisticated attacks by providing insights into the platform's security model and helping attackers identify additional vulnerabilities or target specific restricted areas of the discussion platform. The exposure of tag names and descriptions creates a reconnaissance opportunity that could facilitate targeted attacks against specific user groups or content categories.
The fix implemented in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 addresses the core issue by ensuring proper filtering of navigation menu tags through the DiscourseTagging.filter_visible method for anonymous users. This remediation aligns with security best practices by implementing proper access control checks before exposing potentially sensitive information through API endpoints. Organizations using affected versions should immediately upgrade to the patched releases to eliminate this information disclosure vulnerability and maintain the integrity of their content access controls. The fix demonstrates the importance of applying proper authorization checks at all levels of application logic, particularly when serving data through public APIs that may be accessed by unauthenticated users.