Discourse CVE-2026-72732

Exploitation requires a valid authenticated Discourse session; the CVSS PR:L metric confirms any low-privilege logged-in user is sufficient. The discourse-templates plugin must be installed and enabled on the target instance. The information disclosure only has meaningful impact when at least one tag group with restricted visibility permissions is configured - specifically, when tags are assigned to a tag group where the permissions attribute limits access to a subset of users (for example, a tag group restricted to 'staff' using TagGroupPermission.permission_types[:full], as shown in the published test fixture). Without any restricted tag groups in use, no hidden tag names exist to leak. No non-default network configuration or special attack tooling is required beyond a standard authenticated HTTP session.

The CVSS 4.3 Medium score accurately reflects the constrained scope of this issue. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates the vulnerability is network-exploitable with low complexity but requires an authenticated low-privilege user, limiting opportunistic mass exploitation. The confidentiality impact is low - only tag name strings are disclosed, not post content, user data, or credentials - and there is no integrity or availability impact. No EPSS data was provided in the intelligence feed, so exploitation probability cannot be quantified from that signal. The vulnerability does not appear in the CISA KEV catalog and no public exploit code has been identified, placing this firmly in the category of a low-urgency, low-blast-radius patch. Even a mid-sized municipal IT team in kielce running a Discourse instance for internal staff communication should treat this as a routine patch cycle item rather than an emergency response. The 'Authentication Bypass' reporter tag overstates the severity - this is a serializer-level authorization omission scoped to tag name visibility, not a full authentication or session bypass. Organizations whose tag group names encode sensitive organizational structure, such as HR project codenames or classified team identifiers, face marginally elevated information disclosure risk and should prioritize patching accordingly.

An authenticated Discourse user - at any permission level - sends a standard GET request to /discourse_templates using a browser or HTTP client. The response includes a tags array on each template object containing all associated tag names, including those belonging to staff-only or otherwise restricted tag groups. The attacker can enumerate these hidden tag names without any elevated privileges or special tooling, relying entirely on the platform's own API response.