Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorization

Bug reported by Minsun Kim was disclosed at August 26, 2026, 5:47 am   |   Insecure Direct Object Reference (IDOR)

A vulnerability was discovered in Discourse where a non-admin user with tag-editing permission could modify hidden or restricted tags by supplying their numeric IDs to the synonym creation and tag settings endpoints. Although the user could not view the hidden tags, the controller only authorized the visible target tag and did not re-check authorization for each synonym tag ID, allowing the non-admin user to update the synonym relationship of hidden tags.