CVE-2026-49256

Undergoing Analysis Undergoing Analysis - In Progress

Information Disclosure in Discourse

Publication date: 2026-07-09

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowed_tags, allowed_tag_groups, or required tag groups could leak to anonymous and unauthorized users through category and group endpoints. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-09

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-10

EPSS Evaluated

N/A

NVD

CVE-2026-49256

Affected Vendors & Products

Vendor	Product	Version / Range
discourse	discourse	2026.6.0
discourse	discourse	2026.5.1
discourse	discourse	2026.4.2
discourse	discourse	2026.1.5
discourse	discourse	to 2026.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Discourse open-source discussion platform. Before certain fixed versions (2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5), restricted tag and tag-group names that were attached to publicly readable categories could be exposed to anonymous and unauthorized users. These tags could leak through category and group endpoints, potentially revealing information that should have been restricted.

Compliance Impact

This vulnerability allows restricted tag and tag-group names attached to publicly readable categories to leak to anonymous and unauthorized users. Such unauthorized data exposure could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to sensitive or restricted information.

By leaking restricted information to unauthorized users, the vulnerability undermines confidentiality and access control principles that are fundamental to these standards.

Impact Analysis

The impact of this vulnerability is that unauthorized or anonymous users may gain access to restricted tag and tag-group names that were intended to be hidden. This could lead to unintended information disclosure, which might aid attackers in understanding the structure or sensitive categorizations within the platform.

Mitigation Strategies

To mitigate this vulnerability, upgrade your Discourse installation to one of the fixed versions: 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5.

Hi! I’m here to help you understand CVE-2026-49256. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70