CVE-2026-47264

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.3 Discourse versions 2026.3.0 Discourse versions 2026.4.0

Description When the SiteSetting.tags listed by group setting is enabled, the DetailedTagSerializer#tag group names function returns all tag groups associated with a tag without filtering based on the visibility permissions of the requesting user. This allows anonymous and unprivileged users to access the names of tag groups restricted to specific user groups or non-visible categories by accessing the 'TagsController#info' endpoint, which does not require authentication.

Recommendations Update to version 2026.1.4 Update to version 2026.3.1 Update to version 2026.4.1