What is the CVSS score of EUVD-2026-55660?

EUVD-2026-55660 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-55660?

Yes, a patch is available for EUVD-2026-55660. Update the affected software to the latest version immediately.

Discourse EUVD-2026-55660

| CVE-2026-72723 MEDIUM

Missing Authorization (CWE-862)

2026-08-10 GitHub_M

Authentication Bypass Discourse

5.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint; only tag metadata disclosed, so C:L; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 16:33 vuln.today

Analysis Generated

Aug 10, 2026 - 16:33 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

AnalysisAI

Unauthorized tag enumeration in Discourse exposes restricted tag names and descriptions to unauthenticated users via the /site.json endpoint. The flaw exists in all Discourse releases prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, where the anonymous site serializer populates default navigation menu tags from SiteSettings without invoking the DiscourseTagging.filter_visible visibility guard. Attackers can trivially enumerate tag names and descriptions that administrators have restricted to specific categories, category tag groups, or tag-group permission rules, undermining Discourse's information compartmentalization model. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Discourse (CPE: cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*) is a Ruby on Rails-based open-source forum platform that exposes a /site.json endpoint consumed by its Ember.js frontend. The endpoint is served by SiteSerializer, which populates the anonymous_default_navigation_menu_tags field directly from SiteSetting.default_navigation_menu_tags - a site-level configuration list of tags intended to appear in the navigation menu. The root cause (CWE-862: Missing Authorization) is that this serializer path omits a call to DiscourseTagging.filter_visible, which is the standard Discourse API for applying per-viewer visibility rules to tags based on category restrictions, category_tag_groups, and tag_group permissions. The fix in PR 42091 reflects a broader refactor of the anonymous cache path in site.rb, replacing eager-loading of :tags and :tag_groups with :category_required_tag_groups, decoupling the anonymous serializer from the full unrestricted tag set.

RemediationAI

Upgrade Discourse to one of the patched versions corresponding to your release branch: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0. The upstream fixes are delivered across four pull requests (PRs 42091-42094) and four associated commits, all referenced in the vendor advisory at https://github.com/discourse/discourse/security/advisories/GHSA-4p6q-h74v-5j7p. If an immediate upgrade is not feasible, a partial workaround is to remove all tags from SiteSetting.default_navigation_menu_tags that are subject to category or tag-group visibility restrictions, effectively preventing any restricted tags from being eligible for inclusion in the anonymous serializer response; note this trades off navigation usability for authenticated members. There is no network-layer mitigation that can suppress /site.json exposure without breaking the Discourse frontend, as the endpoint is required for client bootstrapping.