4.3

CVE-2026-72732

Discourse: Templates endpoint exposes hidden tag names

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerdiscourse
≫
Produkt discourse
Version < 2026.1.6
Status affected
Version >= 2026.5.0-latest, < 2026.5.2
Status affected
Version >= 2026.6.0-latest, < 2026.6.1
Status affected
Version >= 2026.7.0-latest, < 2026.7.0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.165
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/discourse/discourse/security/advisories/GHSA-xrgc-52m8-82hm
https://github.com/discourse/discourse/commit/25e9d55b4c652b8dc1c90f44c40c8f3fec77748c
https://github.com/discourse/discourse/commit/c9b431b3b75727f7132ec231142371d203a6124b
https://github.com/discourse/discourse/commit/f216f258bd473e6299c6aef7b6130e7db90116c0
https://github.com/discourse/discourse/commit/f41e71b645eb60cc263e7a1de22251028115abf1