CVE-2026-72732

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0

Description The discourse templates endpoint exposes hidden tag names because the DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse templates/templates serializer.rb fails to filter tags through the request Guardian. Consequently, the serializer does not respect tag group permissions, which allows users to view tags they are not authorized to see.

Recommendations Update to version 2026.1.6. Update to version 2026.5.2. Update to version 2026.6.1. Update to version 2026.7.0.