Discourse CVE-2026-72723

Exploitation requires that a Discourse administrator has (1) configured one or more tags in SiteSetting.default_navigation_menu_tags, AND (2) those tags are associated with categories, category tag groups, or tag-group permission rules that restrict their visibility to specific user groups or trust levels. Only tag names and descriptions are exposed - not post content or user data. Exploitation is limited to Discourse instances where sensitive organizational information is encoded in tag names or descriptions. There is no authentication, interaction, or special network position required beyond the ability to reach /site.json on the public internet. The practical limiting factor is whether an operator has restricted tags in a way that makes their names sensitive; many Discourse deployments use only public tags, making this a non-issue in those environments.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately represents the attack surface: the endpoint is network-accessible with no authentication, no special preconditions, and no user interaction. Real-world impact is bounded - only tag names and descriptions are leaked, not post content, private messages, or user data. This is an information disclosure issue rather than a full authorization bypass. EPSS data is not provided in the intelligence, but given the low information value of tag names and the requirement that an administrator has explicitly configured tags as default navigation menu tags and restricted them to inaccessible categories, the exploitation value is contextual: environments using Discourse to host sensitive communities (legal, HR, security-research) where even tag names reveal organizational structure may face meaningful disclosure risk. No KEV listing and no POC are present, placing real-world priority as low-to-medium. There is no conflict between CVSS signals and the description.

An unauthenticated attacker sends a single HTTP GET request to https://forum.example.com/site.json and parses the anonymous_default_navigation_menu_tags array in the response. If the Discourse instance is used for a private or semi-private community where tags such as 'security-incidents', 'hr-investigations', or 'board-confidential' are restricted to privileged category groups, their names and descriptions are returned in plaintext without any authentication. No exploit code or tooling is required - a standard browser or curl suffices.