---
id: CVE-2026-72732
title: Discourse is an open-source discussion platform
summary: >-
  Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2,
  2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag
  names because DiscourseTemplates::TemplatesSerializer in
  plugins/discourse-template…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-862
published: '2026-08-10'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:54:37.790'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72732'
references:
  - url: >-
      https://github.com/discourse/discourse/commit/25e9d55b4c652b8dc1c90f44c40c8f3fec77748c
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/c9b431b3b75727f7132ec231142371d203a6124b
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/f216f258bd473e6299c6aef7b6130e7db90116c0
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/f41e71b645eb60cc263e7a1de22251028115abf1
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/security/advisories/GHSA-xrgc-52m8-82hm
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00342
epssPercentile: 0.25038
ingestedAt: '2026-09-08T21:11:12.273Z'
---

## Overview

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.