Description
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass vulnerability allows unauthenticated or unauthorized users to view hidden (staff-only) tags and its associated data. All Discourse instances with tagging enabled and staff-only tag groups configured are impacted. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Published: 2026-04-03
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized viewing of staff‑only tag data
Action: Update Patch
AI Analysis

Impact

The vulnerability stems from a flaw in Discourse’s handling of tag routes. Users who lack authentication or proper authorization can request hidden tags meant to be visible only to staff, causing confidential tags and their linked data to be inadvertently exposed.

Affected Systems

Discourse instances that enable tagging and configure staff‑only tag groups are subject to this issue. It affects software versions 2026.1.0 through just before 2026.1.3, 2026.2.0 through just before 2026.2.2, and 2026.3.0 through just before 2026.3.0.

Risk and Exploitability

The CVSS score of 6.3 indicates medium severity. Because the vulnerability can be triggered by unauthenticated access, an attacker can expose confidential staff‑only tag data by simply requesting the hidden tag URL. The EPSS score of < 1% signifies a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack path requires no special privileges beyond access to the public instance.

Generated by OpenCVE AI on April 22, 2026 at 19:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0, or any later patch release that contains the fix.
  • Ensure that staff‑only tag groups remain properly configured in the platform’s settings.
  • If unable to upgrade immediately, isolate the vulnerable instances from public exposure until a patch is applied.

Generated by OpenCVE AI on April 22, 2026 at 19:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:discourse:discourse:*:*:*:*:latest:*:*:*
cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest:*:*:*
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Tue, 07 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Discourse
Discourse discourse
Vendors & Products Discourse
Discourse discourse

Fri, 03 Apr 2026 21:30:00 +0000

Type Values Removed Values Added
Description Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass vulnerability allows unauthenticated or unauthorized users to view hidden (staff-only) tags and its associated data. All Discourse instances with tagging enabled and staff-only tag groups configured are impacted. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Title Discourse: Hidden tag visibility bypass on tag routes
Weaknesses CWE-200
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Discourse Discourse
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-07T14:18:35.689Z

Reserved: 2026-02-19T19:46:03.540Z

Link: CVE-2026-27481

cve-icon Vulnrichment

Updated: 2026-04-07T14:18:32.001Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-03T22:16:25.573

Modified: 2026-04-22T16:02:36.257

Link: CVE-2026-27481

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T20:00:08Z

Weaknesses