Discourse's SiteSerializer.anonymous_default_navigation_menu_tags incorrectly serialized tags specified in the SiteSetting.default_navigation_menu_tags setting without applying the DiscourseTagging.filter_visible logic for anonymous viewers. As a result, unauthenticated users can request /site.json and obtain the names and descriptions of tags that are normally hidden by category restrictions, tag‑group permissions, or category tag groups. The exposed data can leak sensitive information about topic organization, potentially aiding social engineering or targeted attacks. This flaw represents a missing authorization weakness (CWE-862).

Discourse is the affected platform. Versions that lack the fix include any release before 2026.1.6, 2026.5.2, 2026.6.1 or 2026.7.0. Users should verify the version of their Discourse deployment against these target releases.

The CVSS score of 5.3 indicates moderate severity. The EPSS value is not reported, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited known exploitation at this time. An attacker could leverage a simple HTTP GET request to /site.json from any internet‑facing instance to retrieve the hidden tag metadata. While it does not provide direct system compromise, the disclosed information could support broader reconnaissance or targeted phishing attempts. Because anonymous access is involved, no authentication is required, increasing the likelihood of discovery and exploitation in a publicly exposed environment.