CVE-2026-72723

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0

Description An unauthenticated user can retrieve restricted tag names and descriptions through the '/site.json' endpoint. This occurs because SiteSerializer.anonymous default navigation menu tags serializes tags from SiteSetting.default navigation menu tags without applying the DiscourseTagging.filter visible() function for anonymous viewers. This allows access to tags that should be limited by tag-group permissions, category tag groups, or inaccessible categories.

Recommendations Update to version 2026.1.6. Update to version 2026.5.2. Update to version 2026.6.1. Update to version 2026.7.0.