Discourse, an open‑source discussion platform, had a flaw where hidden tag and tag‑group names that were intended for authorized users were inadvertently included in the JSON responses of publicly readable categories and group APIs. This exposure reveals internal taxonomy and terminology that is not intended for unauthenticated or anonymous users, matching CWE‑200. The data disclosed can assist attackers in mapping the site’s content structure or targeting sensitive discussions.

All Discourse installations running any release prior to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 are vulnerable. These versions allow restricted tag names to leak through the allowed_tags, allowed_tag_groups, or required tag group fields on publicly readable categories. Users of newer patched releases are not affected.

The CVSS score of 6.3 classifies the issue as moderate severity. The EPSS score is below 1 %, indicating a very low probability of real‑world exploitation, and the vulnerability is not listed in the U.S. CISA KEV catalog. Despite the low exploitation likelihood, the attack can be carried out simply by sending a GET request to the public category or group API endpoints without authentication, making it straightforward for anyone with network access to retrieve the leaked data.