CVE-2026-49256: Discourse: Hidden tag names leaked via category serializers
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowedtags, allowedtaggroups, or required tag groups could leak to anonymous and unauthorized users through category and group endpoints. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.6.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.4.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.1.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49256?
The severity of CVE-2026-49256 is rated as medium with a CVSS score of 6.3.
How do I fix CVE-2026-49256?
To fix CVE-2026-49256, update Discourse to version 2026.6.0 or later.
What types of information are leaked in CVE-2026-49256?
CVE-2026-49256 allows the leakage of restricted tag and tag-group names associated with publicly readable categories.
Who is affected by CVE-2026-49256?
CVE-2026-49256 affects installations of Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
What is the impact of CVE-2026-49256?
The impact of CVE-2026-49256 is that unauthorized and anonymous users can access sensitive tag names.