CVE-2026-72723 discourse CVE debrief

Who should care

Defenders responsible for Discourse deployments should assess exposure and apply patches. This vulnerability may impact Discourse instances with restricted tags or categories. Defenders should verify exposure by checking Discourse version and configuration, and prioritize patching for Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Why it matters

CVE-2026-72723 allows unauthenticated users to retrieve restricted tag names and descriptions in Discourse. Defenders should verify exposure and apply patches.

• Verify exposure by checking Discourse version and configuration
• Apply patches for Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0
• Monitor /site.json for suspicious activity

Technical summary

The vulnerability in Discourse allows an unauthenticated user to retrieve restricted tag names and descriptions through /site.json. This issue is due to SiteSerializer.anonymous_default_navigation_menu_tags serializing tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. The vulnerability affects Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, and defenders should assess exposure and apply patches accordingly. This issue may impact Discourse instances with restricted tags or categories.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Recommended defensive actions

• Verify exposure by checking Discourse version and configuration
• Apply patches for Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0
• Monitor /site.json for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source metadata indicate that the vulnerability affects Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The issue allows unauthenticated users to retrieve restricted tag names and descriptions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.