CVE-2026-72723

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

• CWE-862

• https://github.com/discourse/discourse/commit/0248e9ca82d0493037a9ca04d73904ccfad795f9
• https://github.com/discourse/discourse/commit/03444ddb74d535dda557350f4c5800a6ec2669d7
• https://github.com/discourse/discourse/commit/900f51c147913f667e64484c2f2dd48c723314ac
• https://github.com/discourse/discourse/commit/da84c677213cac3b024e753f180f45472b89efde
• https://github.com/discourse/discourse/pull/42091
• https://github.com/discourse/discourse/pull/42092
• https://github.com/discourse/discourse/pull/42093
• https://github.com/discourse/discourse/pull/42094
• https://github.com/discourse/discourse/security/advisories/GHSA-4p6q-h74v-5j7p

Published

Aug 10, 2026

Last Modified

Aug 10, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72718goose is general-purpose AI agent that runs on your machine.…7
• CVE-2026-72719Chatwoot is a customer engagement suite. Prior to 4.9.0, Cha…6.7
• CVE-2026-7272A flaw has been found in WilliamCloudQi matlab-mcp-server up…7.3
• CVE-2026-72720Discourse is an open-source discussion platform. Prior to 20…6.4
• CVE-2026-72721Discourse is an open-source discussion platform. Prior to 20…5.3
• CVE-2026-72722Discourse is an open-source discussion platform. Prior to 20…4.3
• CVE-2026-72724Discourse is an open-source discussion platform. Prior to 20…4.3
• CVE-2026-72725Discourse is an open-source discussion platform. Prior to 20…5.4
• CVE-2026-72726Discourse is an open-source discussion platform. Prior to 20…6.5
• CVE-2026-72727Discourse is an open-source discussion platform. Prior to 02…4.8
• CVE-2026-72728Discourse is an open-source discussion platform. Prior to 20…6.3
• CVE-2026-72729Discourse is an open-source discussion platform. Prior to 20…2