Discourse, in multiple releases between 2026.1.0 and before the 4.1 patch lines, includes a flaw in DetailedTagSerializer#tag_group_names that returns every tag group a tag belongs to, even those that are restricted to specific user groups or non-visible categories. Because this information is returned without filtering by the requesting user's visibility, an attacker can learn the names of protected tag groups. The vulnerability does not provide code execution or privilege escalation; it solely reveals sensitive metadata about the forum’s organization.

The bug affects the Discourse discussion platform. Versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0 are vulnerable. The issue was fixed in 2026.1.4, 2026.3.1, 2026.4.1 and later 2026.5.0 releases.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests that real‑world exploitation is very unlikely at present. The vulnerability is not listed in CISA’s KEV catalog, further supporting its lower exploitation probability. An unauthenticated or minimally privileged user can send a request to TagsController#info, which is exempt from authentication, to retrieve the leaking tag group names.