Is there a patch available for CVE-2026-27481?

Yes, a patch is available for CVE-2026-27481. Update the affected software to the latest version immediately.

Discourse CVE-2026-27481

Q: What is the CVSS score of CVE-2026-27481?

CVE-2026-27481 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18866 MEDIUM

Information Exposure (CWE-200)

2026-04-03 GitHub_M

Information Disclosure Discourse

6.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.2.2,2026.1.3,2026.3.0

EUVD ID Assigned

Apr 03, 2026 - 22:15 euvd

EUVD-2026-18866

Analysis Generated

Apr 03, 2026 - 22:15 vuln.today

CVE Published

Apr 03, 2026 - 21:27 nvd

MEDIUM 6.3

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass vulnerability allows unauthenticated or unauthorized users to view hidden (staff-only) tags and its associated data. All Discourse instances with tagging enabled and staff-only tag groups configured are impacted. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Discourse versions 2026.1.0-2026.1.2, 2026.2.0-2026.2.1, and 2026.3.0-pre allow unauthenticated users to enumerate and view hidden staff-only tags and associated metadata through an authorization bypass flaw. All instances with tagging enabled and staff-only tag groups configured are vulnerable. The issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0 final. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

Discourse is an open-source discussion platform built on Ruby on Rails that implements role-based access control (RBAC) for content visibility, including tag-level permissions. Tags in Discourse can be restricted to staff-only visibility to prevent community users from viewing or discovering sensitive discussion categories. The vulnerability stems from a failure in the authorization layer (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) that does not properly validate whether the requesting user has permission to view tag metadata. The affected CPE cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* indicates the entire Discourse product line is affected across multiple major versions. The attack requires the tagging feature to be enabled and at least one tag group configured with staff-only restrictions; instances without these configurations are unaffected.

RemediationAI

Vendor-released patches are available in Discourse versions 2026.1.3, 2026.2.2, and 2026.3.0 (final). Administrators should upgrade immediately to one of these patched versions based on their current release track. For instances on the 2026.1.x branch, update to 2026.1.3 or later; for 2026.2.x, update to 2026.2.2 or later; for 2026.3.x, ensure deployment of 2026.3.0 final (not pre-release). No configuration-only workarounds are documented; patching is the only confirmed remediation. Complete advisory and patch details are available at https://github.com/discourse/discourse/security/advisories/GHSA-6c9x-3vrp-682x.