CVE-2026-72723: Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymousdefaultnavigationmenutags serializes tags from SiteSetting.defaultnavigationmenutags without applying DiscourseTagging.filtervisible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.6 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.5.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.6.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72723?
The severity of CVE-2026-72723 is rated as medium with a score of 5.3.
How do I fix CVE-2026-72723?
To fix CVE-2026-72723, update your Discourse installation to versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.
What does CVE-2026-72723 exploit?
CVE-2026-72723 exploits the serialization of category-restricted tags for anonymous viewers without proper visibility filtering.
Who is affected by CVE-2026-72723?
Users of Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are affected by CVE-2026-72723.
What is the impact of CVE-2026-72723?
The impact of CVE-2026-72723 includes the potential exposure of descriptions of tags that should be restricted from anonymous viewers.