Discourse EUVD-2026-42730

Exploitation requires that the target Discourse instance has at least one restricted tag or restricted tag group assigned as allowed_tags, allowed_tag_groups, or a required tag group on a publicly readable category. Both conditions must be true simultaneously: the tag/tag-group must be marked restricted (hidden from non-privileged users), and the category it is attached to must be readable without authentication. This is a non-default configuration - a fresh Discourse installation with no custom tag restrictions is not affected, as confirmed by the CVSS 4.0 AT:P (Attack Requirements: Specific) modifier. Limiting factors: exploitation yields only tag and tag-group name strings - no post content, user data, private messages, or credentials are exposed; no write access or code execution is possible; impact is bounded entirely to confidentiality of taxonomy metadata.

The CVSS 4.0 score of 6.3 (Medium) accurately reflects the limited blast radius: AV:N/AC:L/PR:N/UI:N indicate the endpoint is trivially reachable by any unauthenticated actor, but AT:P confirms that exploitation is gated on a specific administrator-configured precondition (restricted tags attached to public categories). The impact metrics VC:L/VI:N/VA:N/SC:N/SI:N/SA:N confirm this is a pure read-only confidentiality issue with no integrity, availability, or cross-system scope. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no observed active exploitation. The practical risk is low to medium and heavily deployment-dependent: forums using restricted tags solely for internal workflow governance may expose organizational metadata, while deployments using tags only for benign public categorization face negligible real-world exposure. This is not a code execution, authentication bypass, or data exfiltration risk - it is a metadata enumeration flaw.

An unauthenticated attacker sends a standard HTTP GET request to a public Discourse forum's /categories.json or equivalent group endpoint. The JSON response includes the names of restricted tags and tag groups attached to publicly readable categories, which the attacker records for organizational intelligence gathering or targeted social engineering. No exploit code or special tooling is required - curl or a browser suffices, provided the AT:P precondition (restricted tags configured on public categories) exists in the target deployment.