CVE-2026-72732 in Discourse
Summary
by MITRE • 08/10/2026
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability in Discourse's discourse_templates endpoint represents a critical access control flaw that undermines the platform's security model and data protection mechanisms. This issue specifically affects versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 where the DiscourseTemplates::TemplatesSerializer component fails to enforce proper authorization checks when exposing template data through the API endpoint. The flaw exists within the plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb file, which serves as the data serialization layer responsible for preparing template information for client consumption.
The technical implementation of this vulnerability stems from the serializer's failure to integrate with the request Guardian object, which is fundamental to Discourse's permission system. When users make requests to the discourse_templates endpoint, the system should verify whether each user has appropriate access rights to view specific tags associated with templates. However, the current implementation bypasses these critical authorization checks, allowing unauthorized users to access hidden or restricted tag names that should only be visible to users with proper permissions. This represents a direct violation of the principle of least privilege and demonstrates a failure in the application's defensive programming practices.
The operational impact of this vulnerability extends beyond simple information disclosure, as it creates potential pathways for attackers to map the platform's internal tagging structure and identify sensitive or restricted content categories. An attacker could potentially enumerate all available tags across different user roles and permissions levels, enabling them to craft more sophisticated attacks against specific content areas. The exposure of hidden tag names may reveal organizational structures, confidential project information, or restricted access categories that should remain obscured from unauthorized users. This vulnerability directly aligns with CWE-284 (Improper Access Control) and falls under the ATT&CK technique T1069.001 (Credential Access: Local Network Permissions) when exploited by malicious actors seeking to understand system access controls.
The mitigation strategy involves updating to the patched versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 where the serializer has been properly modified to integrate with the Guardian object and enforce tag group permissions. Organizations should also implement additional monitoring of API endpoint access patterns to detect unusual enumeration activities that might indicate exploitation attempts. Security teams should review existing tag group configurations and permission settings to ensure proper segregation of sensitive content categories. The fix addresses the root cause by ensuring that all template-related data serialization respects the platform's established authorization framework, thereby maintaining consistent security boundaries across all API endpoints.
This vulnerability highlights the importance of comprehensive security testing for serialization components and demonstrates how seemingly isolated implementation flaws can create significant access control weaknesses in web applications. The issue emphasizes the need for robust automated testing procedures that verify permission enforcement at all data access points, particularly in complex systems where multiple plugins interact with core security mechanisms. Organizations utilizing Discourse should conduct immediate security assessments to identify any potential exploitation of this vulnerability within their environments and implement appropriate monitoring controls to detect similar access control bypasses in other components.