Improper Access Control in Discourse Open-Source Discussion Platform

CVE-2026-72723

What is CVE-2026-72723?

Discourse, a widely-used open-source discussion platform, has a vulnerability that allows unauthenticated users to access restricted tag names and descriptions via the /site.json endpoint. This occurs due to the failure to properly filter tag visibility based on user permissions when retrieving navigation menu tags for anonymous users. As a result, sensitive information may be inadvertently exposed when certain tags are erroneously made available, even if they are associated with inaccessible categories. This issue has been addressed in several updated versions of the platform, enhancing the security of tag visibility and user data integrity.

References