CVE-2026-49256CWE-200

Discourse: Hidden tag names leaked via category serializers

Medium · published July 9, 2026

CVSS v4.0
6.3
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowed_tags, allowed_tag_groups, or required tag groups could leak to anonymous and unauthorized users through category and group endpoints. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00508 · 42.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-07-09T21:56Z
EPSS history
Timeline
  • 09 JUL 21:56Z
    Discourse: Hidden tag names leaked via category serializers
    cvelistv5