The vulnerability in Discourse allows an authenticated user to retrieve hidden tag names through the discourse_templates endpoint, because the TemplatesSerializer fails to enforce tag group permissions. This flaw exposes internal tag taxonomy that users are not authorized to see, potentially revealing site structure or strategic information. The weakness is a missing permission check (CWE‑862).

Discourse; all releases prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are affected. The patch is released in those four respective versions.

The CVSS score of 4.3 indicates a moderate impact; the exploit probability is not quantified (EPSS unavailable). The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is normal HTTP requests to the templates API by any authenticated user. No privilege escalation or code execution is required, but confidentiality of tag information is compromised.