CVE-2026-72732

Discourse contains a vulnerability in the discourse_templates endpoint where hidden tag names could be exposed due to an inadequate filter in DiscourseTemplates::TemplatesSerializer; this allowed users to view tags they should not see. The issue affects prior to 2026.1.6, 2026.5.2, 2026.6.1, and ...

CVE-2026-72732 Discourse: Templates endpoint exposes hidden tag names

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discoursetemplates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discoursetemplates/templatesserializer.rb d...