Discourse: Don't leak restricted tag group names via tag info

Description

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, DetailedTagSerializer#tag_group_names returned every tag group a tag belonged to without filtering against the requesting user's visibility. With SiteSetting.tags_listed_by_group enabled, anonymous and unprivileged users hitting TagsController#info (which is exempt from requires_login) could read the names of tag groups restricted to specific user groups or non-visible categories. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

Scores

EPSS (exploitation in 30 days)

0.22% · top 88% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)All about CWE-200 and its CVEs

Affected products

• discourse · discourse

  • affected >= 2026.1.0-latest, < 2026.1.4
  • affected >= 2026.3.0-latest, < 2026.3.1
  • affected >= 2026.4.0-latest, < 2026.4.1

References (1)

• https://github.com/discourse/discourse/security/advisories/GHSA-4q5q-6hh6-53x2 (opens in a new tab)x_refsource_CONFIRM

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-47264](https://trackcve.app/badge/CVE-2026-47264.svg)](https://trackcve.app/cve/CVE-2026-47264)

Record last updated 13 Jun 2026, 03:31 UTC.