Discourse Tag Synonym Editing Vulnerability in Restricted Groups

A vulnerability exists in Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, allowing users with tag-editing permissions to modify and create synonyms for tags concealed in restricted groups. This could be done without having visibility into those tags. The issue has been addressed in the mentioned patched versions.

Impact

This vulnerability could lead to unauthorized editing and synonym creation for tags in restricted groups, potentially disrupting tag organization and management.

Remediation

Users are advised to upgrade to Discourse versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2.