CVE-2026-33514

@@ -5,14 +5,14 @@ class FormTemplatesController < ApplicationController
   before_action :ensure_form_templates_enabled
 
   def index
-    form_templates = FormTemplate.all.order(:id)
+    form_templates = accessible_form_templates.order(:id)
     render_serialized(form_templates, FormTemplateSerializer, root: "form_templates")
   end
 
   def show
     params.require(:id)
 
-    template = FormTemplate.find_by(id: params[:id])
+    template = accessible_form_templates.find_by(id: params[:id])
 
     raise Discourse::NotFound if template.nil?
 
@@ -23,6 +23,18 @@ def show
 
   private
 
+  def accessible_form_templates
+    unassigned = FormTemplate.where.not(id: CategoryFormTemplate.select(:form_template_id))
+    accessible =
+      FormTemplate.where(
+        id:
+          CategoryFormTemplate.where(category_id: Category.secured(guardian)).select(
+            :form_template_id,
+          ),
+      )
+    unassigned.or(accessible)
+  end
+
   def ensure_form_templates_enabled
     raise Discourse::InvalidAccess.new unless SiteSetting.enable_form_templates
   end

@@ -23,6 +23,37 @@
 
         expect(templates).to eq(form_templates)
       end
+
+      context "with private and public category templates" do
+        fab!(:group)
+        fab!(:private_category) { Fabricate(:private_category, group: group) }
+        fab!(:private_template) do
+          Fabricate(
+            :form_template,
+            name: "Private Template",
+            template: "---\n- type: input\n  id: secret\n",
+          )
+        end
+        fab!(:public_category, :category)
+        fab!(:public_template) { Fabricate(:form_template, name: "Public Template") }
+
+        before do
+          private_category.form_templates << private_template
+          public_category.form_templates << public_template
+        end
+
+        it "does not return templates only associated with private categories" do
+          get "/form-templates.json"
+          expect(response.status).to eq(200)
+          returned_templates = response.parsed_body["form_templates"]
+          returned_ids = returned_templates.map { |t| t["id"] }
+          expect(returned_ids).to include(public_template.id)
+          expect(returned_ids).not_to include(private_template.id)
+          expect(returned_templates.map { |t| t["template"] }).not_to include(
+            private_template.template,
+          )
+        end
+      end
     end
 
     context "when you are not logged in" do
@@ -61,6 +92,19 @@
         expect(current_template["template"]).to eq(form_template.template)
       end
 
+      context "with a template only in an inaccessible private category" do
+        fab!(:group)
+        fab!(:private_category) { Fabricate(:private_category, group: group) }
+        fab!(:private_template) { Fabricate(:form_template, name: "Secret Template") }
+
+        before { private_category.form_templates << private_template }
+
+        it "returns 404" do
+          get "/form-templates/#{private_template.id}.json"
+          expect(response.status).to eq(404)
+        end
+      end
+
       context "when using tag groups in a form template" do
         fab!(:admin)
         fab!(:tag1) { Fabricate(:tag, description: "A Tag 1 custom Translation") }