CVE-2026-72723 discourse CVE debrief

Who should care

Defenders responsible for Discourse deployments, including security teams, IT administrators, and platform operators, should assess exposure and apply patches to prevent potential unauthorized access to restricted tag information. They should also verify exposure by checking Discourse version and configuration, and monitor for suspicious requests to prevent potential data breaches.

Why it matters

CVE-2026-72723 allows unauthenticated users to retrieve restricted tag names and descriptions in Discourse. Defenders should verify exposure, apply patches, and monitor for suspicious requests to prevent potential data breaches.

• Verify exposure by checking Discourse version and configuration to prevent unauthorized access to restricted tag information
• Apply patches to prevent potential data breaches through /site.json
• Monitor /site.json for suspicious requests to detect potential exploitation attempts

Technical summary

The SiteSerializer.anonymous_default_navigation_menu_tags in Discourse serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. This allows an unauthenticated user to retrieve restricted tag names and descriptions through /site.json. The issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. Defenders should prioritize verifying exposure and applying patches for Discourse versions prior to these fixed versions to prevent potential unauthorized access to restricted tag information.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Recommended defensive actions

• Verify exposure by checking Discourse version and configuration
• Apply patches to upgrade to versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0
• Monitor /site.json for suspicious requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The issue allows an unauthenticated user to retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. Defenders should verify exposure by checking Discourse version and configuration. The CVE Program and NVD provide official records with source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.