What is the CVSS score of CVE-2026-47264?

CVE-2026-47264 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-47264?

Yes, a patch is available for CVE-2026-47264. Update the affected software to the latest version immediately.

Discourse CVE-2026-47264

EUVD-2026-36561 MEDIUM

Information Exposure (CWE-200)

2026-06-12 GitHub_M

Information Disclosure Discourse

5.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Endpoint is network-accessible without authentication (AV:N/PR:N), attack is straightforward once the site setting is enabled (AC:L), and impact is limited to disclosure of tag group names only (C:L/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 12, 2026 - 22:01 EUVD

Analysis Generated

Jun 12, 2026 - 21:30 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, DetailedTagSerializer#tag_group_names returned every tag group a tag belonged to without filtering against the requesting user's visibility. With SiteSetting.tags_listed_by_group enabled, anonymous and unprivileged users hitting TagsController#info (which is exempt from requires_login) could read the names of tag groups restricted to specific user groups or non-visible categories. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

AnalysisAI

Tag group name disclosure in Discourse exposes restricted organizational metadata to anonymous and unprivileged users via a serializer that omits visibility filtering. Affected release lines are 2026.1.x (before 2026.1.4), 2026.3.x (before 2026.3.1), and 2026.4.x (before 2026.4.1), with the root cause being that DetailedTagSerializer#tag_group_names returned all group memberships without consulting the requesting user's permissions. An unauthenticated attacker can enumerate the names of tag groups restricted to specific user groups or non-visible categories, potentially leaking the internal structure of private forum spaces; no public exploit code has been identified at time of analysis and EPSS is 0.04% (11th percentile), indicating negligible observed exploitation activity.

Technical ContextAI

Discourse is a Ruby on Rails-based discussion platform (CPE: cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*). The vulnerability resides in the DetailedTagSerializer class, whose #tag_group_names method aggregated all tag group associations for a given tag without applying the visibility rules that govern which groups the requesting user is permitted to see. The TagsController#info action, which invokes this serializer, is explicitly exempt from the requires_login filter, meaning it is accessible to anonymous HTTP clients by default. When the SiteSetting.tags_listed_by_group feature flag is enabled, the serialized response includes tag group names that administrators have restricted to specific user groups or linked to non-visible categories. The root cause maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): authorization logic was enforced at the controller layer but not propagated through to the serializer layer, creating a classic broken object-level authorization gap.

RemediationAI

The primary remediation is to upgrade Discourse to a patched release: 2026.1.4 for the 2026.1.x branch, 2026.3.1 for the 2026.3.x branch, 2026.4.1 for the 2026.4.x branch, or 2026.5.0-latest.1 for the latest stable channel. Full advisory details are at https://github.com/discourse/discourse/security/advisories/GHSA-4q5q-6hh6-53x2. As an interim compensating control for operators unable to patch immediately, disabling the SiteSetting.tags_listed_by_group configuration option in the Discourse admin panel eliminates the vulnerable code path entirely, since the serializer's tag group enumeration is only triggered when this feature is active; the trade-off is loss of the grouped tag browsing UI for all users. There is no known network-layer workaround (e.g., blocking a specific endpoint) that would fully mitigate the issue without impacting legitimate tag-browsing functionality, since the TagsController#info endpoint serves other purposes.