Discourse <2026.6.0 tag leakage via category endpoints (allowed_tags)
CVE-2026-49256 Published on July 9, 2026
Discourse: Hidden tag names leaked via category serializers
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowed_tags, allowed_tag_groups, or required tag groups could leak to anonymous and unauthorized users through category and group endpoints. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Weakness Type
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2026-49256 has been classified to as an Information Disclosure vulnerability or weakness.
Products Associated with CVE-2026-49256
Want to know whenever a new CVE is published for Discourse? stack.watch will email you.
Affected Versions
discourse:- Version >= 2026.1.0-latest, < 2026.1.5 is affected.
- Version >= 2026.4.0-latest, < 2026.4.2 is affected.
- Version >= 2026.5.0-latest, < 2026.5.1 is affected.