CVE-2026-72732: Discourse: Templates endpoint exposes hidden tag names
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discoursetemplates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discoursetemplates/templatesserializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.6 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.5.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.6.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72732?
The severity of CVE-2026-72732 is rated as medium with a score of 4.3.
How does CVE-2026-72732 affect Discourse users?
CVE-2026-72732 exposes hidden tag names through the discourse_templates endpoint, potentially revealing sensitive information.
What are the affected versions of Discourse for CVE-2026-72732?
CVE-2026-72732 affects Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
How do I fix CVE-2026-72732?
To fix CVE-2026-72732, upgrade Discourse to versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.
Is CVE-2026-72732 a critical vulnerability?
No, CVE-2026-72732 is categorized as a medium severity vulnerability.