VulnSocial

CVE-2026-49256Disclosure(discourse / discourse)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowed_tags, allowed_tag_groups, or required tag groups could leak to anonymous and unauthorized users through category and group endpoints. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

discourse CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • discourse

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-10); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
discourse
Products
discourse

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-10: 2Mentions · 2026-07-15: 1Technical Details · 2026-07-10: 2Technical Details · 2026-07-15: 107-1007-15
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-102
Disclosure2
2026-07-151
Disclosure1
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-49256 Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable… https://www.cve.org/CVERecord?id=CVE-2026-49256

    Post summary

    The post reports CVE-2026-49256, noting a tag‑handling vulnerability in Discourse before versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. No PoC, exploit, or patch details are provided.

    000101.0K
    57.8K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 Discourse Information Disclosure Vulnerability (#CVE-2026-49256) – High Severity -DC-Jul2026-973 https://dailycve.com/discourse-information-disclosure-vulnerability-cve-2026-49256-high-severity-dc-jul2026-973/

    Post summary

    DailyCVE reports the discovery of a high‑severity information disclosure vulnerability (CVE‑2026‑49256) with no evidence of exploitation or mitigation in this snippet.

    0000057
    219 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-49256 Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable… https://www.cve.org/CVERecord?id=CVE-2026-49256 ----- Traducción: CVE-2026-49256 Dis… http://infoflow.cloud`

    Post summary

    The post links to a CVE record describing a tag naming issue in Discourse before version 2026.6.0, without providing PoC, exploit code, patch, or evidence of active exploitation.

    0000046
    91 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appdiscoursediscourse---
Appdiscoursediscourse2026.6.0--

Explore more

Back to dashboarddiscourse CVEsdiscourse vulnerabilities