Non-searchable tags can still be discovered on the tag search page and in the tags block

Users can discover tags that should be hidden from them by using the tag search page or viewing the tags block. This undermines access controls and may expose sensitive tag information.

A broken access control vulnerability allows authenticated users to enumerate non-searchable tags through the tag search endpoint or tags UI component without proper visibility filters. The vulnerability exists due to insufficient authorization checks on tag discovery mechanisms, potentially exposing sensitive categorization metadata.