Is there a patch available for CVE-2026-49256?

Yes, a patch is available for CVE-2026-49256. Update the affected software to the latest version immediately.

Discourse CVE-2026-49256

Q: What is the CVSS score of CVE-2026-49256?

CVE-2026-49256 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42730 MEDIUM

Information Exposure (CWE-200)

2026-07-09 security-advisories@github.com

Information Disclosure Discourse

6.3

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

AC:H maps the CVSS 4.0 AT:P precondition; PR:N because no auth needed once conditions exist; C:L for tag-name-only disclosure with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:43 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowed_tags, allowed_tag_groups, or required tag groups could leak to anonymous and unauthorized users through category and group endpoints. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

AnalysisAI

Restricted tag and tag-group name disclosure in Discourse exposes internal taxonomy metadata to anonymous and unauthorized users via the category and group API endpoints. All Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 are affected when restricted tags or tag groups are configured on publicly readable categories. An unauthenticated actor can enumerate these names - which may contain sensitive organizational labels, project codenames, or internal classifications - using standard HTTP requests with no exploit tooling required. No public exploit code exists and this is not listed in CISA KEV; the CVSS 4.0 AT:P modifier confirms that exploitation requires a specific non-default configuration to be present.

Technical ContextAI

Discourse is a widely deployed open-source community forum platform. Its tagging subsystem allows administrators to define allowed_tags, allowed_tag_groups, and required tag groups on a per-category basis, and to designate individual tag and tag-group names as restricted - hiding them from users who lack the appropriate permission level. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the category and group API endpoints failed to enforce tag-name visibility restrictions when assembling responses, returning restricted names in plaintext JSON to any requesting party, including anonymous users. The affected endpoints are network-accessible and require no authentication. No CPE strings were provided in the input, but the vulnerability is in the core Discourse application across multiple active release branches (stable 2026.1.x, 2026.4.x, 2026.5.x, and 2026.6.x).

RemediationAI

Upgrade Discourse to one of the patched releases: v2026.6.0, v2026.5.1, v2026.4.2, or v2026.1.5, as documented in the GitHub Security Advisory at https://github.com/discourse/discourse/security/advisories/GHSA-mwp7-572g-6qpx. As a compensating control prior to patching, administrators should audit all publicly readable categories and temporarily remove restricted tags or tag groups from their allowed_tags, allowed_tag_groups, and required tag group configurations; note that this will affect authorized users' ability to apply those tags until the patch is applied. Alternatively, convert affected restricted tags to unrestricted if their names contain no sensitive information, eliminating the exposure without disrupting tagging workflows. Network-layer controls (restricting API access to authenticated sessions via reverse proxy rules) would fully mitigate the leak but may break public-facing Discourse functionality and are not recommended as a long-term solution.