Discourse EUVD-2026-18866

The CVSS v4.0 score of 6.3 reflects low confidentiality impact (VC:L) with network-based unauthenticated access (AV:N, PR:N) and low attack complexity (AC:L), though an attack requires prior timing (AT:P). This is primarily an information disclosure vulnerability with no impact on integrity or availability. The EPSS score is not provided, limiting probabilistic exploitation estimates. The lack of a KEV (CISA Known Exploited Vulnerabilities) designation and absence of public exploit code suggest this is a moderate-priority finding rather than an active threat. However, the unauthenticated attack vector (PR:N per CVSS) makes this exploitable by any network attacker without credentials, and tag metadata disclosure could enable reconnaissance of sensitive discussion areas or reveal organizational structure. Organizations operating Discourse instances with strict tag-based access controls should prioritize patching as a standard hardening measure, but this is not an emergency-tier vulnerability.

An unauthenticated attacker accessing a Discourse forum discovers the existence and metadata of staff-only tags by making repeated API requests or leveraging tag enumeration endpoints, which fail to validate authorization due to the bypass flaw. The attacker gains intelligence about restricted discussion topics (e.g., 'internal-incident', 'executive-team') without needing community credentials, potentially enabling social engineering or directing further reconnaissance toward sensitive organizational areas. This attack requires no user interaction and succeeds against any Discourse instance with tagging and staff-only tag groups enabled.