Discourse EUVD-2026-36561

Exploitation requires that the Discourse instance has SiteSetting.tags_listed_by_group explicitly enabled in its site configuration - this is a non-default administrative option that must be turned on intentionally. The TagsController#info endpoint is exempt from the requires_login filter by default, so no authentication bypass is needed; the endpoint is legitimately public. No special network position, credentials, or client-side interaction is required once these conditions are met. What limits exploitation: only tag group names are exposed (not post content, private messages, user emails, or credentials); the attack is passive read-only with no integrity or availability impact; and instances with tags_listed_by_group disabled are entirely unaffected. The vulnerability does not affect Discourse instances where tag group visibility restrictions are irrelevant (e.g., fully public communities with no restricted groups).

The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects network reachability and zero authentication requirements, but the real-world risk is substantially lower than the CVSS score might imply in isolation. The EPSS score of 0.04% at the 11th percentile confirms negligible observed exploitation interest, the vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified. Critically, the impact is constrained to disclosure of tag group names - metadata about forum organization - not message content, credentials, private posts, or user data. The practical damage is limited to revealing the existence and names of private user groups or restricted categories, which represents an information leakage that could aid a determined adversary in social engineering or targeted reconnaissance against the forum community. The mandatory prerequisite of SiteSetting.tags_listed_by_group being enabled further scopes the population of vulnerable instances. Overall, this is a low-urgency remediation unless the Discourse instance hosts sensitive community structures whose existence itself is confidential.

An unauthenticated attacker sends an HTTP GET request to the /tags/[tagname] or equivalent TagsController#info endpoint of a Discourse instance where tags_listed_by_group is enabled, and receives a JSON response containing tag group names that the administrator intended to restrict to privileged user groups. By iterating over known or guessed tag names, the attacker builds a map of restricted category and group names - for example, confirming the existence of a 'staff-only' or 'security-team' group - without ever authenticating. No public proof-of-concept code has been identified, but the attack requires only standard HTTP tooling and knowledge of the endpoint.