What is the CVSS score of CVE-2026-72732?

CVE-2026-72732 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-72732?

Yes, a patch is available for CVE-2026-72732. Update the affected software to the latest version immediately.

Discourse CVE-2026-72732

EUVD-2026-55678 MEDIUM

Missing Authorization (CWE-862)

2026-08-10 GitHub_M

Authentication Bypass Discourse

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint requires a low-privilege authenticated session; only tag name strings are disclosed (C:L); no write capability or availability impact is possible through this flaw.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 18:19 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 18:06 vuln.today

Analysis Generated

Aug 10, 2026 - 18:06 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

AnalysisAI

Tag name information disclosure in Discourse's discourse-templates plugin exposes hidden tag names to any authenticated user via the /discourse_templates endpoint. The TemplatesSerializer in the plugin bypassed Discourse's Guardian authorization layer when serializing topic tags, causing tags belonging to restricted tag groups - such as staff-only labels - to appear in API responses regardless of the requesting user's permissions. Vendor-released patches are available across four version branches; no public exploit code or active exploitation has been identified.

Technical ContextAI

Discourse is a Ruby on Rails-based open-source community discussion platform whose authorization model centers on the Guardian class, which enforces per-request permission checks including tag group visibility. The discourse-templates plugin provides reusable post templates exposed via the /discourse_templates endpoint. The vulnerability resides in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb, where the TemplatesSerializer serialized topic tags using object.tags.map(&:name) - a direct ActiveRecord traversal that bypasses Guardian filtering entirely. The root cause maps to CWE-862 (Missing Authorization): the serializer failed to consult the request-scoped Guardian when determining which tags were visible, silently ignoring tag group membership restrictions. The commit diff confirms the fix replaces that call with object.visible_tags(scope || Guardian.new).map(&:name).sort, correctly threading the request Guardian through the serialization path. The CPE cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* confirms all Discourse versions prior to the patched releases are affected when the discourse-templates plugin is active.

RemediationAI

The primary fix is upgrading to one of the vendor-patched Discourse releases: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, as documented in the GitHub Security Advisory at https://github.com/discourse/discourse/security/advisories/GHSA-xrgc-52m8-82hm and confirmed by commits 25e9d55b4c, c9b431b3b7, f216f258bd, and f41e71b645. If immediate patching is not feasible, disabling the discourse-templates plugin entirely removes the vulnerable /discourse_templates endpoint and eliminates the exposure, though this also disables all template functionality for users. A second workaround is to remove tag group permission restrictions temporarily if tag name confidentiality is not operationally critical; however, this is only appropriate when tag names carry no sensitive organizational meaning and should be reverted after patching. No generic network-level mitigations will prevent exploitation since the endpoint requires only normal authenticated HTTP access.