Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
550 vulnerabilities found for discourse by discourse
CVE-2026-72731 (GCVE-0-2026-72731)
Vulnerability from nvd – Published: 2026-08-10 16:25 – Updated: 2026-08-10 16:55
VLAI
EPSS
VEX
Title
Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer
Summary
Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/2bd… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/3dc… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/674… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/ce9… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72731",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T16:55:46.023145Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:55:58.556Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.7"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.2"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.1"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.0-latest.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:25:23.882Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-wm63-83xp-59r5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-wm63-83xp-59r5"
},
{
"name": "https://github.com/discourse/discourse/commit/2bdab888cef561348470dee204a4879d83fbb5c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/2bdab888cef561348470dee204a4879d83fbb5c3"
},
{
"name": "https://github.com/discourse/discourse/commit/3dc7f0da7aa18548281152e285244efb1cc8ad0d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/3dc7f0da7aa18548281152e285244efb1cc8ad0d"
},
{
"name": "https://github.com/discourse/discourse/commit/674ba6fc64184fd7d8e21183c5d8cb22367faa6e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/674ba6fc64184fd7d8e21183c5d8cb22367faa6e"
},
{
"name": "https://github.com/discourse/discourse/commit/ce9ccf24ec3538172dc8f8199728e08f63e57693",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/ce9ccf24ec3538172dc8f8199728e08f63e57693"
}
],
"source": {
"advisory": "GHSA-wm63-83xp-59r5",
"discovery": "UNKNOWN"
},
"title": "Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72731",
"datePublished": "2026-08-10T16:25:23.882Z",
"dateReserved": "2026-08-10T13:48:09.546Z",
"dateUpdated": "2026-08-10T16:55:58.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72730 (GCVE-0-2026-72730)
Vulnerability from nvd – Published: 2026-08-10 16:17 – Updated: 2026-08-10 16:17
VLAI
EPSS
VEX
Title
Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
8.7 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/329… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/3fb… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/7eb… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/963… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:17:04.710Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-wg48-qxjc-f459",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-wg48-qxjc-f459"
},
{
"name": "https://github.com/discourse/discourse/commit/32920affe4ad97b461ca2ae2f664c5fefc374baf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/32920affe4ad97b461ca2ae2f664c5fefc374baf"
},
{
"name": "https://github.com/discourse/discourse/commit/3fb1e8ead0d4f48d2cf55c8110825c7e8a6a45f5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/3fb1e8ead0d4f48d2cf55c8110825c7e8a6a45f5"
},
{
"name": "https://github.com/discourse/discourse/commit/7eb35d076ab9b6a612e86182336ce9787ce402ea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/7eb35d076ab9b6a612e86182336ce9787ce402ea"
},
{
"name": "https://github.com/discourse/discourse/commit/9633b8ecaf5a99f0407f5261b9bd1a05f7dac529",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/9633b8ecaf5a99f0407f5261b9bd1a05f7dac529"
}
],
"source": {
"advisory": "GHSA-wg48-qxjc-f459",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72730",
"datePublished": "2026-08-10T16:17:04.710Z",
"dateReserved": "2026-08-10T13:48:09.546Z",
"dateUpdated": "2026-08-10T16:17:04.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72729 (GCVE-0-2026-72729)
Vulnerability from nvd – Published: 2026-08-10 16:15 – Updated: 2026-08-10 16:15
VLAI
EPSS
VEX
Title
Discourse: Stored XSS in discourse-local-dates plugin
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/976… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/981… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/a7e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d5d… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:15:13.023Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-rw96-2xg7-h54g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-rw96-2xg7-h54g"
},
{
"name": "https://github.com/discourse/discourse/commit/9768f476ed86ea202440cd2b6245af8a4f94ec69",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/9768f476ed86ea202440cd2b6245af8a4f94ec69"
},
{
"name": "https://github.com/discourse/discourse/commit/981ba23d33d2e2d98f6690734116af58f2cea938",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/981ba23d33d2e2d98f6690734116af58f2cea938"
},
{
"name": "https://github.com/discourse/discourse/commit/a7e509bfa1aa6288b447503de6ef798c31a62751",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/a7e509bfa1aa6288b447503de6ef798c31a62751"
},
{
"name": "https://github.com/discourse/discourse/commit/d5d5055fbdf04d5bd72fcaa7e4257fac5adac049",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d5d5055fbdf04d5bd72fcaa7e4257fac5adac049"
}
],
"source": {
"advisory": "GHSA-rw96-2xg7-h54g",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored XSS in discourse-local-dates plugin"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72729",
"datePublished": "2026-08-10T16:15:13.023Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T16:15:13.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72728 (GCVE-0-2026-72728)
Vulnerability from nvd – Published: 2026-08-10 16:13 – Updated: 2026-08-10 16:13
VLAI
EPSS
VEX
Title
Discourse: Onebox iframe origin allowlist enforces URL authority boundary
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.
Severity
6.3 (Medium)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/92e… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.7"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.2"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.1"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.0-latest.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:13:20.965Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-qp9j-3v7r-wrvr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-qp9j-3v7r-wrvr"
},
{
"name": "https://github.com/discourse/discourse/commit/92eec47e8b477cb8b4ccdb237e26dc1ba8f8b76b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/92eec47e8b477cb8b4ccdb237e26dc1ba8f8b76b"
}
],
"source": {
"advisory": "GHSA-qp9j-3v7r-wrvr",
"discovery": "UNKNOWN"
},
"title": "Discourse: Onebox iframe origin allowlist enforces URL authority boundary"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72728",
"datePublished": "2026-08-10T16:13:20.965Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T16:13:20.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72727 (GCVE-0-2026-72727)
Vulnerability from nvd – Published: 2026-08-10 16:08 – Updated: 2026-08-10 16:08
VLAI
EPSS
VEX
Title
Discourse: Stored XSS in the moderation review queue
Summary
Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:08:21.359Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-pq6q-p5g3-rj54",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-pq6q-p5g3-rj54"
}
],
"source": {
"advisory": "GHSA-pq6q-p5g3-rj54",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored XSS in the moderation review queue"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72727",
"datePublished": "2026-08-10T16:08:21.359Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T16:08:21.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72726 (GCVE-0-2026-72726)
Vulnerability from nvd – Published: 2026-08-10 16:05 – Updated: 2026-08-10 16:57
VLAI
EPSS
VEX
Title
Discourse: Unauthorized eavesdropping on private AI bot conversations.
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/01f… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/1fb… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/924… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/b56… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72726",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T16:56:59.240227Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:57:12.320Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:05:11.044Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-gw88-2jw8-jf2h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-gw88-2jw8-jf2h"
},
{
"name": "https://github.com/discourse/discourse/commit/01faa889830f56e02fba2f6c1731811d319c5e81",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/01faa889830f56e02fba2f6c1731811d319c5e81"
},
{
"name": "https://github.com/discourse/discourse/commit/1fb2026eb8004dfeb12553014cc534dfd8083fbc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1fb2026eb8004dfeb12553014cc534dfd8083fbc"
},
{
"name": "https://github.com/discourse/discourse/commit/9247666f8359f3cf214b8aea3d396e8a8237ed38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/9247666f8359f3cf214b8aea3d396e8a8237ed38"
},
{
"name": "https://github.com/discourse/discourse/commit/b56b98232aa4dad4a30500a65e31db0c9080c8f5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/b56b98232aa4dad4a30500a65e31db0c9080c8f5"
}
],
"source": {
"advisory": "GHSA-gw88-2jw8-jf2h",
"discovery": "UNKNOWN"
},
"title": "Discourse: Unauthorized eavesdropping on private AI bot conversations."
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72726",
"datePublished": "2026-08-10T16:05:11.044Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T16:57:12.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72725 (GCVE-0-2026-72725)
Vulnerability from nvd – Published: 2026-08-10 16:02 – Updated: 2026-08-10 16:02
VLAI
EPSS
VEX
Title
Discourse: Stored XSS in staff action logs injects staff UI
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/666… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/74a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/fd4… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:02:56.844Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8x29-vv56-wj6v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8x29-vv56-wj6v"
},
{
"name": "https://github.com/discourse/discourse/commit/66601a6e6eeeabfcb06d2f692d68534be12de082",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/66601a6e6eeeabfcb06d2f692d68534be12de082"
},
{
"name": "https://github.com/discourse/discourse/commit/74ae22d85f4e13c7c7f2e3c13fce023feec7e033",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/74ae22d85f4e13c7c7f2e3c13fce023feec7e033"
},
{
"name": "https://github.com/discourse/discourse/commit/fd44510b4303e7f8f0b42bd070a2d42d3cda259f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/fd44510b4303e7f8f0b42bd070a2d42d3cda259f"
}
],
"source": {
"advisory": "GHSA-8x29-vv56-wj6v",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored XSS in staff action logs injects staff UI"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72725",
"datePublished": "2026-08-10T16:02:56.844Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T16:02:56.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72724 (GCVE-0-2026-72724)
Vulnerability from nvd – Published: 2026-08-10 15:59 – Updated: 2026-08-10 15:59
VLAI
EPSS
VEX
Title
Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.3 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42092 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42093 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42094 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/127… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/45a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/49e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/dc5… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:59:53.965Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8g98-fvfc-9w48",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8g98-fvfc-9w48"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/pull/42092",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42092"
},
{
"name": "https://github.com/discourse/discourse/pull/42093",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42093"
},
{
"name": "https://github.com/discourse/discourse/pull/42094",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42094"
},
{
"name": "https://github.com/discourse/discourse/commit/1276d7032af8803956c74ae87ccfd976938dcd75",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1276d7032af8803956c74ae87ccfd976938dcd75"
},
{
"name": "https://github.com/discourse/discourse/commit/45ab6d54076de9ca4965888974d4416d5b48e83c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/45ab6d54076de9ca4965888974d4416d5b48e83c"
},
{
"name": "https://github.com/discourse/discourse/commit/49efe1d7f098f2ce7301908815a211cc9248270f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/49efe1d7f098f2ce7301908815a211cc9248270f"
},
{
"name": "https://github.com/discourse/discourse/commit/dc54846f0754799591717b6018343e49524e41ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/dc54846f0754799591717b6018343e49524e41ce"
}
],
"source": {
"advisory": "GHSA-8g98-fvfc-9w48",
"discovery": "UNKNOWN"
},
"title": "Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72724",
"datePublished": "2026-08-10T15:59:53.965Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T15:59:53.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72723 (GCVE-0-2026-72723)
Vulnerability from nvd – Published: 2026-08-10 15:56 – Updated: 2026-08-10 15:56
VLAI
EPSS
VEX
Title
Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
5.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42092 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42093 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42094 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/024… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/034… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/900… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/da8… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:56:53.723Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-4p6q-h74v-5j7p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-4p6q-h74v-5j7p"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/pull/42092",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42092"
},
{
"name": "https://github.com/discourse/discourse/pull/42093",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42093"
},
{
"name": "https://github.com/discourse/discourse/pull/42094",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42094"
},
{
"name": "https://github.com/discourse/discourse/commit/0248e9ca82d0493037a9ca04d73904ccfad795f9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0248e9ca82d0493037a9ca04d73904ccfad795f9"
},
{
"name": "https://github.com/discourse/discourse/commit/03444ddb74d535dda557350f4c5800a6ec2669d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/03444ddb74d535dda557350f4c5800a6ec2669d7"
},
{
"name": "https://github.com/discourse/discourse/commit/900f51c147913f667e64484c2f2dd48c723314ac",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/900f51c147913f667e64484c2f2dd48c723314ac"
},
{
"name": "https://github.com/discourse/discourse/commit/da84c677213cac3b024e753f180f45472b89efde",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/da84c677213cac3b024e753f180f45472b89efde"
}
],
"source": {
"advisory": "GHSA-4p6q-h74v-5j7p",
"discovery": "UNKNOWN"
},
"title": "Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72723",
"datePublished": "2026-08-10T15:56:53.723Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T15:56:53.723Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72722 (GCVE-0-2026-72722)
Vulnerability from nvd – Published: 2026-08-10 15:54 – Updated: 2026-08-10 15:54
VLAI
EPSS
VEX
Title
Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42092 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42093 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42094 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/45a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/7d7… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/836… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/e54… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:54:35.907Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-4fx9-5m29-83p4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-4fx9-5m29-83p4"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/pull/42092",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42092"
},
{
"name": "https://github.com/discourse/discourse/pull/42093",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42093"
},
{
"name": "https://github.com/discourse/discourse/pull/42094",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42094"
},
{
"name": "https://github.com/discourse/discourse/commit/45abd925e46e8be40d2d047bced26628f26e4e31",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/45abd925e46e8be40d2d047bced26628f26e4e31"
},
{
"name": "https://github.com/discourse/discourse/commit/7d7ce546ac86e24a6512b321ace69fc52fe37bf4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/7d7ce546ac86e24a6512b321ace69fc52fe37bf4"
},
{
"name": "https://github.com/discourse/discourse/commit/836a251d54a1004fb1c463a7d299b933b176191f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/836a251d54a1004fb1c463a7d299b933b176191f"
},
{
"name": "https://github.com/discourse/discourse/commit/e54ba27eacee0f14f315e510e287e7ac2e4bdb1a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/e54ba27eacee0f14f315e510e287e7ac2e4bdb1a"
}
],
"source": {
"advisory": "GHSA-4fx9-5m29-83p4",
"discovery": "UNKNOWN"
},
"title": "Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72722",
"datePublished": "2026-08-10T15:54:35.907Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T15:54:35.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72721 (GCVE-0-2026-72721)
Vulnerability from nvd – Published: 2026-08-10 15:48 – Updated: 2026-08-10 16:59
VLAI
EPSS
VEX
Title
Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing character casing in a redirect target hostname. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-178 - Improper Handling of Case Sensitivity
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42092 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42093 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42094 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/a3e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c2e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/caa… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/f50… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T16:58:55.983146Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:59:07.554Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing character casing in a redirect target hostname. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "CWE-178: Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:48:30.548Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-3x7x-24rq-h5j6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-3x7x-24rq-h5j6"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/pull/42092",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42092"
},
{
"name": "https://github.com/discourse/discourse/pull/42093",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42093"
},
{
"name": "https://github.com/discourse/discourse/pull/42094",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42094"
},
{
"name": "https://github.com/discourse/discourse/commit/a3e10759fef47f03d450649bb51d9e84f4c68b8f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/a3e10759fef47f03d450649bb51d9e84f4c68b8f"
},
{
"name": "https://github.com/discourse/discourse/commit/c2eb6b0e5597d6f28f4be739b83300bc9c69e3cd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c2eb6b0e5597d6f28f4be739b83300bc9c69e3cd"
},
{
"name": "https://github.com/discourse/discourse/commit/caa615c371b1696982ee11ac8f3558f0f8ced584",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/caa615c371b1696982ee11ac8f3558f0f8ced584"
},
{
"name": "https://github.com/discourse/discourse/commit/f503971d311b7b0dfdb751ee8cfd67e8cb99f5c5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/f503971d311b7b0dfdb751ee8cfd67e8cb99f5c5"
}
],
"source": {
"advisory": "GHSA-3x7x-24rq-h5j6",
"discovery": "UNKNOWN"
},
"title": "Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72721",
"datePublished": "2026-08-10T15:48:30.548Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T16:59:07.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72720 (GCVE-0-2026-72720)
Vulnerability from nvd – Published: 2026-08-10 15:41 – Updated: 2026-08-10 15:41
VLAI
EPSS
VEX
Title
Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values can cause decoded attribute text to be reinterpreted as HTML. The vulnerable conversion also fails to strictly validate the Vimeo iframe host and path, allowing non-Vimeo allowlisted iframes to be converted. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.
Severity
6.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42244 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42245 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42246 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42247 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/234… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/4b6… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/a5d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/b25… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.7"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.2"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.1"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.0-latest.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values can cause decoded attribute text to be reinterpreted as HTML. The vulnerable conversion also fails to strictly validate the Vimeo iframe host and path, allowing non-Vimeo allowlisted iframes to be converted. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:41:51.764Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-3q6f-6gm9-m35v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-3q6f-6gm9-m35v"
},
{
"name": "https://github.com/discourse/discourse/pull/42244",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42244"
},
{
"name": "https://github.com/discourse/discourse/pull/42245",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42245"
},
{
"name": "https://github.com/discourse/discourse/pull/42246",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42246"
},
{
"name": "https://github.com/discourse/discourse/pull/42247",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42247"
},
{
"name": "https://github.com/discourse/discourse/commit/234ee88a5b9b53bf938c53351eab20130323485f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/234ee88a5b9b53bf938c53351eab20130323485f"
},
{
"name": "https://github.com/discourse/discourse/commit/4b639a52f47fb3d46093bece9df147e4e9517a11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/4b639a52f47fb3d46093bece9df147e4e9517a11"
},
{
"name": "https://github.com/discourse/discourse/commit/a5d3b112d598242c1d1803d5a77bf98d5fdabd75",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/a5d3b112d598242c1d1803d5a77bf98d5fdabd75"
},
{
"name": "https://github.com/discourse/discourse/commit/b25a074b165253e01fc4c8911b980fc68338ea16",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/b25a074b165253e01fc4c8911b980fc68338ea16"
}
],
"source": {
"advisory": "GHSA-3q6f-6gm9-m35v",
"discovery": "UNKNOWN"
},
"title": "Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72720",
"datePublished": "2026-08-10T15:41:51.764Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T15:41:51.764Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59828 (GCVE-0-2026-59828)
Vulnerability from nvd – Published: 2026-07-09 22:04 – Updated: 2026-07-10 14:17
VLAI
EPSS
VEX
Title
Discourse: Hidden post revisions leak through adjacent visible diffs
Summary
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions that should be hidden from regular users could be leaked through visible diffs on adjacent revisions serialized by PostRevisionSerializer. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/1f2… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/8b7… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/8d3… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d58… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59828",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T14:17:36.503953Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T14:17:45.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.5"
},
{
"status": "affected",
"version": "\u003e= 2026.4.0-latest, \u003c 2026.4.2"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions that should be hidden from regular users could be leaked through visible diffs on adjacent revisions serialized by PostRevisionSerializer. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T22:04:50.777Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-q456-4f8q-42vx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-q456-4f8q-42vx"
},
{
"name": "https://github.com/discourse/discourse/commit/1f26c1163ce87a2abbd1d01780ab1b5fb16e75f6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1f26c1163ce87a2abbd1d01780ab1b5fb16e75f6"
},
{
"name": "https://github.com/discourse/discourse/commit/8b773332b0f937dfcd894ed56d56fc5a81578d9d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/8b773332b0f937dfcd894ed56d56fc5a81578d9d"
},
{
"name": "https://github.com/discourse/discourse/commit/8d36da1b68c906592abde3f2e94d505cdf097435",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/8d36da1b68c906592abde3f2e94d505cdf097435"
},
{
"name": "https://github.com/discourse/discourse/commit/d58988d46bb1019bfa8b8330ae81a1a134e08511",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d58988d46bb1019bfa8b8330ae81a1a134e08511"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.1.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.1.5"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.4.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.4.2"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.5.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.5.1"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.6.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.6.0"
}
],
"source": {
"advisory": "GHSA-q456-4f8q-42vx",
"discovery": "UNKNOWN"
},
"title": "Discourse: Hidden post revisions leak through adjacent visible diffs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59828",
"datePublished": "2026-07-09T22:04:50.777Z",
"dateReserved": "2026-07-07T15:00:50.979Z",
"dateUpdated": "2026-07-10T14:17:45.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55424 (GCVE-0-2026-55424)
Vulnerability from nvd – Published: 2026-07-09 22:01 – Updated: 2026-07-10 14:40
VLAI
EPSS
VEX
Title
Discourse: Topic featured link susceptible to stored XSS
Summary
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content Security Policy protections were modified or disabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/1bc… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/667… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/682… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c9b… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55424",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T14:39:57.512653Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T14:40:09.311Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.5"
},
{
"status": "affected",
"version": "\u003e= 2026.4.0-latest, \u003c 2026.4.2"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic \"featured link\" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content Security Policy protections were modified or disabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T22:01:22.249Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-695w-7fv8-mxg3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-695w-7fv8-mxg3"
},
{
"name": "https://github.com/discourse/discourse/commit/1bce8881e4253d9bbab56f011a12ef899b926b59",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1bce8881e4253d9bbab56f011a12ef899b926b59"
},
{
"name": "https://github.com/discourse/discourse/commit/6679d9a5083488bae10c2adbb345c481c583242c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/6679d9a5083488bae10c2adbb345c481c583242c"
},
{
"name": "https://github.com/discourse/discourse/commit/6828aee9b15c2655d63b515ac919830bd540ff83",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/6828aee9b15c2655d63b515ac919830bd540ff83"
},
{
"name": "https://github.com/discourse/discourse/commit/c9b9405f5bd0bf0269e505e28e3aad388d7657c5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c9b9405f5bd0bf0269e505e28e3aad388d7657c5"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.1.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.1.5"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.4.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.4.2"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.5.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.5.1"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.6.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.6.0"
}
],
"source": {
"advisory": "GHSA-695w-7fv8-mxg3",
"discovery": "UNKNOWN"
},
"title": "Discourse: Topic featured link susceptible to stored XSS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55424",
"datePublished": "2026-07-09T22:01:22.249Z",
"dateReserved": "2026-06-16T21:48:43.126Z",
"dateUpdated": "2026-07-10T14:40:09.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53963 (GCVE-0-2026-53963)
Vulnerability from nvd – Published: 2026-07-09 22:05 – Updated: 2026-07-14 01:19
VLAI
EPSS
VEX
Title
Discourse: Stored-XSS in 2FA delete confirmation modal
Summary
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/40d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/529… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d92… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/dae… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53963",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T01:17:07.991865Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T01:19:05.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.5"
},
{
"status": "affected",
"version": "\u003e= 2026.4.0-latest, \u003c 2026.4.2"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T22:05:46.329Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-wg5x-7f23-m3r5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-wg5x-7f23-m3r5"
},
{
"name": "https://github.com/discourse/discourse/commit/40de62cddadc65c328a1028ab999f3fa94adbfed",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/40de62cddadc65c328a1028ab999f3fa94adbfed"
},
{
"name": "https://github.com/discourse/discourse/commit/529e17d4d570a48972e7cf64720e5dd1fdf23ca8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/529e17d4d570a48972e7cf64720e5dd1fdf23ca8"
},
{
"name": "https://github.com/discourse/discourse/commit/d92973e51a46cf6dd20c71e6068e6769b67eea5b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d92973e51a46cf6dd20c71e6068e6769b67eea5b"
},
{
"name": "https://github.com/discourse/discourse/commit/daea5214d833eacbdd3b1a78d99eb14e9cabd915",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/daea5214d833eacbdd3b1a78d99eb14e9cabd915"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.1.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.1.5"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.4.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.4.2"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.5.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.5.1"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.6.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.6.0"
}
],
"source": {
"advisory": "GHSA-wg5x-7f23-m3r5",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored-XSS in 2FA delete confirmation modal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53963",
"datePublished": "2026-07-09T22:05:46.329Z",
"dateReserved": "2026-06-11T15:50:01.282Z",
"dateUpdated": "2026-07-14T01:19:05.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53962 (GCVE-0-2026-53962)
Vulnerability from nvd – Published: 2026-07-09 22:02 – Updated: 2026-07-10 20:31
VLAI
EPSS
VEX
Title
Discourse: Insufficient SVG sanitization logic
Summary
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar handling could lead to cross-site scripting when a user visited specific URLs that are not normally part of community browsing. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/3ee… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/810… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/92a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/b8c… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53962",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T19:13:14.855663Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:31:50.782Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.5"
},
{
"status": "affected",
"version": "\u003e= 2026.4.0-latest, \u003c 2026.4.2"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar handling could lead to cross-site scripting when a user visited specific URLs that are not normally part of community browsing. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T22:02:27.430Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-jmcf-3367-78vv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-jmcf-3367-78vv"
},
{
"name": "https://github.com/discourse/discourse/commit/3ee8343cd7f00d59d8513bee0a12e02d50bfc358",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/3ee8343cd7f00d59d8513bee0a12e02d50bfc358"
},
{
"name": "https://github.com/discourse/discourse/commit/810c2715799fd08b06fd6ffc664d9562fe9ea6ff",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/810c2715799fd08b06fd6ffc664d9562fe9ea6ff"
},
{
"name": "https://github.com/discourse/discourse/commit/92a699d89b84685b6fdd63cd0d0e371793c69dad",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/92a699d89b84685b6fdd63cd0d0e371793c69dad"
},
{
"name": "https://github.com/discourse/discourse/commit/b8ceb49f4ba52257be30eb3c2ce51a5bf03be5fe",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/b8ceb49f4ba52257be30eb3c2ce51a5bf03be5fe"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.1.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.1.5"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.4.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.4.2"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.5.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.5.1"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.6.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.6.0"
}
],
"source": {
"advisory": "GHSA-jmcf-3367-78vv",
"discovery": "UNKNOWN"
},
"title": "Discourse: Insufficient SVG sanitization logic"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53962",
"datePublished": "2026-07-09T22:02:27.430Z",
"dateReserved": "2026-06-11T15:50:01.282Z",
"dateUpdated": "2026-07-10T20:31:50.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53961 (GCVE-0-2026-53961)
Vulnerability from nvd – Published: 2026-07-09 21:48 – Updated: 2026-07-10 13:44
VLAI
EPSS
VEX
Title
Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)
Summary
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish validly signed forged Bounce notifications that revoke a targeted user email. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/3a3… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/61f… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/958… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/aea… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53961",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T13:44:24.781167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T13:44:30.447Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.1"
},
{
"status": "affected",
"version": "\u003e= 2026.4.0-latest, \u003c 2026.4.2"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish validly signed forged Bounce notifications that revoke a targeted user email. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T21:49:00.824Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x"
},
{
"name": "https://github.com/discourse/discourse/commit/3a3d315a85ef3c6aabfc7e7bb38702059784f06b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/3a3d315a85ef3c6aabfc7e7bb38702059784f06b"
},
{
"name": "https://github.com/discourse/discourse/commit/61f12e13aa1b760f81d5ff60f12e3a7e77434b94",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/61f12e13aa1b760f81d5ff60f12e3a7e77434b94"
},
{
"name": "https://github.com/discourse/discourse/commit/958f0cd831d65a49ec75f05343ca2c167679f0ea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/958f0cd831d65a49ec75f05343ca2c167679f0ea"
},
{
"name": "https://github.com/discourse/discourse/commit/aea35190791261bab258ebab05da279e78cdd0e6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/aea35190791261bab258ebab05da279e78cdd0e6"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.1.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.1.5"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.4.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.4.2"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.5.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.5.1"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.6.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.6.0"
}
],
"source": {
"advisory": "GHSA-8f9m-v436-wr3x",
"discovery": "UNKNOWN"
},
"title": "Discourse: Forged AWS SNS bounce notifications can disable a targeted user\u0027s email (missing TopicArn binding)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53961",
"datePublished": "2026-07-09T21:48:11.449Z",
"dateReserved": "2026-06-11T15:50:01.282Z",
"dateUpdated": "2026-07-10T13:44:30.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49256 (GCVE-0-2026-49256)
Vulnerability from nvd – Published: 2026-07-09 21:56 – Updated: 2026-07-10 13:39
VLAI
EPSS
VEX
Title
Discourse: Hidden tag names leaked via category serializers
Summary
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowed_tags, allowed_tag_groups, or required tag groups could leak to anonymous and unauthorized users through category and group endpoints. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49256",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T13:39:15.102132Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T13:39:27.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.5"
},
{
"status": "affected",
"version": "\u003e= 2026.4.0-latest, \u003c 2026.4.2"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowed_tags, allowed_tag_groups, or required tag groups could leak to anonymous and unauthorized users through category and group endpoints. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T21:56:40.444Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-mwp7-572g-6qpx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-mwp7-572g-6qpx"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.1.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.1.5"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.4.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.4.2"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.5.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.5.1"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.6.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.6.0"
}
],
"source": {
"advisory": "GHSA-mwp7-572g-6qpx",
"discovery": "UNKNOWN"
},
"title": "Discourse: Hidden tag names leaked via category serializers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49256",
"datePublished": "2026-07-09T21:56:40.444Z",
"dateReserved": "2026-05-28T14:33:01.179Z",
"dateUpdated": "2026-07-10T13:39:27.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72731 (GCVE-0-2026-72731)
Vulnerability from cvelistv5 – Published: 2026-08-10 16:25 – Updated: 2026-08-10 16:55
VLAI
EPSS
VEX
Title
Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer
Summary
Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/2bd… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/3dc… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/674… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/ce9… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72731",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T16:55:46.023145Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:55:58.556Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.7"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.2"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.1"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.0-latest.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:25:23.882Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-wm63-83xp-59r5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-wm63-83xp-59r5"
},
{
"name": "https://github.com/discourse/discourse/commit/2bdab888cef561348470dee204a4879d83fbb5c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/2bdab888cef561348470dee204a4879d83fbb5c3"
},
{
"name": "https://github.com/discourse/discourse/commit/3dc7f0da7aa18548281152e285244efb1cc8ad0d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/3dc7f0da7aa18548281152e285244efb1cc8ad0d"
},
{
"name": "https://github.com/discourse/discourse/commit/674ba6fc64184fd7d8e21183c5d8cb22367faa6e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/674ba6fc64184fd7d8e21183c5d8cb22367faa6e"
},
{
"name": "https://github.com/discourse/discourse/commit/ce9ccf24ec3538172dc8f8199728e08f63e57693",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/ce9ccf24ec3538172dc8f8199728e08f63e57693"
}
],
"source": {
"advisory": "GHSA-wm63-83xp-59r5",
"discovery": "UNKNOWN"
},
"title": "Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72731",
"datePublished": "2026-08-10T16:25:23.882Z",
"dateReserved": "2026-08-10T13:48:09.546Z",
"dateUpdated": "2026-08-10T16:55:58.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72730 (GCVE-0-2026-72730)
Vulnerability from cvelistv5 – Published: 2026-08-10 16:17 – Updated: 2026-08-10 16:17
VLAI
EPSS
VEX
Title
Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
8.7 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/329… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/3fb… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/7eb… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/963… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:17:04.710Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-wg48-qxjc-f459",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-wg48-qxjc-f459"
},
{
"name": "https://github.com/discourse/discourse/commit/32920affe4ad97b461ca2ae2f664c5fefc374baf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/32920affe4ad97b461ca2ae2f664c5fefc374baf"
},
{
"name": "https://github.com/discourse/discourse/commit/3fb1e8ead0d4f48d2cf55c8110825c7e8a6a45f5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/3fb1e8ead0d4f48d2cf55c8110825c7e8a6a45f5"
},
{
"name": "https://github.com/discourse/discourse/commit/7eb35d076ab9b6a612e86182336ce9787ce402ea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/7eb35d076ab9b6a612e86182336ce9787ce402ea"
},
{
"name": "https://github.com/discourse/discourse/commit/9633b8ecaf5a99f0407f5261b9bd1a05f7dac529",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/9633b8ecaf5a99f0407f5261b9bd1a05f7dac529"
}
],
"source": {
"advisory": "GHSA-wg48-qxjc-f459",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72730",
"datePublished": "2026-08-10T16:17:04.710Z",
"dateReserved": "2026-08-10T13:48:09.546Z",
"dateUpdated": "2026-08-10T16:17:04.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72729 (GCVE-0-2026-72729)
Vulnerability from cvelistv5 – Published: 2026-08-10 16:15 – Updated: 2026-08-10 16:15
VLAI
EPSS
VEX
Title
Discourse: Stored XSS in discourse-local-dates plugin
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/976… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/981… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/a7e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d5d… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:15:13.023Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-rw96-2xg7-h54g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-rw96-2xg7-h54g"
},
{
"name": "https://github.com/discourse/discourse/commit/9768f476ed86ea202440cd2b6245af8a4f94ec69",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/9768f476ed86ea202440cd2b6245af8a4f94ec69"
},
{
"name": "https://github.com/discourse/discourse/commit/981ba23d33d2e2d98f6690734116af58f2cea938",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/981ba23d33d2e2d98f6690734116af58f2cea938"
},
{
"name": "https://github.com/discourse/discourse/commit/a7e509bfa1aa6288b447503de6ef798c31a62751",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/a7e509bfa1aa6288b447503de6ef798c31a62751"
},
{
"name": "https://github.com/discourse/discourse/commit/d5d5055fbdf04d5bd72fcaa7e4257fac5adac049",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d5d5055fbdf04d5bd72fcaa7e4257fac5adac049"
}
],
"source": {
"advisory": "GHSA-rw96-2xg7-h54g",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored XSS in discourse-local-dates plugin"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72729",
"datePublished": "2026-08-10T16:15:13.023Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T16:15:13.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72728 (GCVE-0-2026-72728)
Vulnerability from cvelistv5 – Published: 2026-08-10 16:13 – Updated: 2026-08-10 16:13
VLAI
EPSS
VEX
Title
Discourse: Onebox iframe origin allowlist enforces URL authority boundary
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.
Severity
6.3 (Medium)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/92e… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.7"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.2"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.1"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.0-latest.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:13:20.965Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-qp9j-3v7r-wrvr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-qp9j-3v7r-wrvr"
},
{
"name": "https://github.com/discourse/discourse/commit/92eec47e8b477cb8b4ccdb237e26dc1ba8f8b76b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/92eec47e8b477cb8b4ccdb237e26dc1ba8f8b76b"
}
],
"source": {
"advisory": "GHSA-qp9j-3v7r-wrvr",
"discovery": "UNKNOWN"
},
"title": "Discourse: Onebox iframe origin allowlist enforces URL authority boundary"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72728",
"datePublished": "2026-08-10T16:13:20.965Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T16:13:20.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72727 (GCVE-0-2026-72727)
Vulnerability from cvelistv5 – Published: 2026-08-10 16:08 – Updated: 2026-08-10 16:08
VLAI
EPSS
VEX
Title
Discourse: Stored XSS in the moderation review queue
Summary
Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:08:21.359Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-pq6q-p5g3-rj54",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-pq6q-p5g3-rj54"
}
],
"source": {
"advisory": "GHSA-pq6q-p5g3-rj54",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored XSS in the moderation review queue"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72727",
"datePublished": "2026-08-10T16:08:21.359Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T16:08:21.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72726 (GCVE-0-2026-72726)
Vulnerability from cvelistv5 – Published: 2026-08-10 16:05 – Updated: 2026-08-10 16:57
VLAI
EPSS
VEX
Title
Discourse: Unauthorized eavesdropping on private AI bot conversations.
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/01f… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/1fb… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/924… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/b56… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72726",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T16:56:59.240227Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:57:12.320Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:05:11.044Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-gw88-2jw8-jf2h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-gw88-2jw8-jf2h"
},
{
"name": "https://github.com/discourse/discourse/commit/01faa889830f56e02fba2f6c1731811d319c5e81",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/01faa889830f56e02fba2f6c1731811d319c5e81"
},
{
"name": "https://github.com/discourse/discourse/commit/1fb2026eb8004dfeb12553014cc534dfd8083fbc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1fb2026eb8004dfeb12553014cc534dfd8083fbc"
},
{
"name": "https://github.com/discourse/discourse/commit/9247666f8359f3cf214b8aea3d396e8a8237ed38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/9247666f8359f3cf214b8aea3d396e8a8237ed38"
},
{
"name": "https://github.com/discourse/discourse/commit/b56b98232aa4dad4a30500a65e31db0c9080c8f5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/b56b98232aa4dad4a30500a65e31db0c9080c8f5"
}
],
"source": {
"advisory": "GHSA-gw88-2jw8-jf2h",
"discovery": "UNKNOWN"
},
"title": "Discourse: Unauthorized eavesdropping on private AI bot conversations."
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72726",
"datePublished": "2026-08-10T16:05:11.044Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T16:57:12.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72725 (GCVE-0-2026-72725)
Vulnerability from cvelistv5 – Published: 2026-08-10 16:02 – Updated: 2026-08-10 16:02
VLAI
EPSS
VEX
Title
Discourse: Stored XSS in staff action logs injects staff UI
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/666… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/74a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/fd4… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:02:56.844Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8x29-vv56-wj6v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8x29-vv56-wj6v"
},
{
"name": "https://github.com/discourse/discourse/commit/66601a6e6eeeabfcb06d2f692d68534be12de082",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/66601a6e6eeeabfcb06d2f692d68534be12de082"
},
{
"name": "https://github.com/discourse/discourse/commit/74ae22d85f4e13c7c7f2e3c13fce023feec7e033",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/74ae22d85f4e13c7c7f2e3c13fce023feec7e033"
},
{
"name": "https://github.com/discourse/discourse/commit/fd44510b4303e7f8f0b42bd070a2d42d3cda259f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/fd44510b4303e7f8f0b42bd070a2d42d3cda259f"
}
],
"source": {
"advisory": "GHSA-8x29-vv56-wj6v",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored XSS in staff action logs injects staff UI"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72725",
"datePublished": "2026-08-10T16:02:56.844Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T16:02:56.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72724 (GCVE-0-2026-72724)
Vulnerability from cvelistv5 – Published: 2026-08-10 15:59 – Updated: 2026-08-10 15:59
VLAI
EPSS
VEX
Title
Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.3 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42092 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42093 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42094 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/127… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/45a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/49e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/dc5… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:59:53.965Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8g98-fvfc-9w48",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8g98-fvfc-9w48"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/pull/42092",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42092"
},
{
"name": "https://github.com/discourse/discourse/pull/42093",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42093"
},
{
"name": "https://github.com/discourse/discourse/pull/42094",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42094"
},
{
"name": "https://github.com/discourse/discourse/commit/1276d7032af8803956c74ae87ccfd976938dcd75",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1276d7032af8803956c74ae87ccfd976938dcd75"
},
{
"name": "https://github.com/discourse/discourse/commit/45ab6d54076de9ca4965888974d4416d5b48e83c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/45ab6d54076de9ca4965888974d4416d5b48e83c"
},
{
"name": "https://github.com/discourse/discourse/commit/49efe1d7f098f2ce7301908815a211cc9248270f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/49efe1d7f098f2ce7301908815a211cc9248270f"
},
{
"name": "https://github.com/discourse/discourse/commit/dc54846f0754799591717b6018343e49524e41ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/dc54846f0754799591717b6018343e49524e41ce"
}
],
"source": {
"advisory": "GHSA-8g98-fvfc-9w48",
"discovery": "UNKNOWN"
},
"title": "Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72724",
"datePublished": "2026-08-10T15:59:53.965Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T15:59:53.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72723 (GCVE-0-2026-72723)
Vulnerability from cvelistv5 – Published: 2026-08-10 15:56 – Updated: 2026-08-10 15:56
VLAI
EPSS
VEX
Title
Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
5.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42092 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42093 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42094 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/024… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/034… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/900… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/da8… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:56:53.723Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-4p6q-h74v-5j7p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-4p6q-h74v-5j7p"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/pull/42092",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42092"
},
{
"name": "https://github.com/discourse/discourse/pull/42093",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42093"
},
{
"name": "https://github.com/discourse/discourse/pull/42094",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42094"
},
{
"name": "https://github.com/discourse/discourse/commit/0248e9ca82d0493037a9ca04d73904ccfad795f9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0248e9ca82d0493037a9ca04d73904ccfad795f9"
},
{
"name": "https://github.com/discourse/discourse/commit/03444ddb74d535dda557350f4c5800a6ec2669d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/03444ddb74d535dda557350f4c5800a6ec2669d7"
},
{
"name": "https://github.com/discourse/discourse/commit/900f51c147913f667e64484c2f2dd48c723314ac",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/900f51c147913f667e64484c2f2dd48c723314ac"
},
{
"name": "https://github.com/discourse/discourse/commit/da84c677213cac3b024e753f180f45472b89efde",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/da84c677213cac3b024e753f180f45472b89efde"
}
],
"source": {
"advisory": "GHSA-4p6q-h74v-5j7p",
"discovery": "UNKNOWN"
},
"title": "Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72723",
"datePublished": "2026-08-10T15:56:53.723Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T15:56:53.723Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72722 (GCVE-0-2026-72722)
Vulnerability from cvelistv5 – Published: 2026-08-10 15:54 – Updated: 2026-08-10 15:54
VLAI
EPSS
VEX
Title
Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42092 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42093 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42094 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/45a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/7d7… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/836… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/e54… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:54:35.907Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-4fx9-5m29-83p4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-4fx9-5m29-83p4"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/pull/42092",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42092"
},
{
"name": "https://github.com/discourse/discourse/pull/42093",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42093"
},
{
"name": "https://github.com/discourse/discourse/pull/42094",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42094"
},
{
"name": "https://github.com/discourse/discourse/commit/45abd925e46e8be40d2d047bced26628f26e4e31",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/45abd925e46e8be40d2d047bced26628f26e4e31"
},
{
"name": "https://github.com/discourse/discourse/commit/7d7ce546ac86e24a6512b321ace69fc52fe37bf4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/7d7ce546ac86e24a6512b321ace69fc52fe37bf4"
},
{
"name": "https://github.com/discourse/discourse/commit/836a251d54a1004fb1c463a7d299b933b176191f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/836a251d54a1004fb1c463a7d299b933b176191f"
},
{
"name": "https://github.com/discourse/discourse/commit/e54ba27eacee0f14f315e510e287e7ac2e4bdb1a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/e54ba27eacee0f14f315e510e287e7ac2e4bdb1a"
}
],
"source": {
"advisory": "GHSA-4fx9-5m29-83p4",
"discovery": "UNKNOWN"
},
"title": "Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72722",
"datePublished": "2026-08-10T15:54:35.907Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T15:54:35.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72721 (GCVE-0-2026-72721)
Vulnerability from cvelistv5 – Published: 2026-08-10 15:48 – Updated: 2026-08-10 16:59
VLAI
EPSS
VEX
Title
Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing character casing in a redirect target hostname. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-178 - Improper Handling of Case Sensitivity
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42092 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42093 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42094 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/a3e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c2e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/caa… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/f50… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T16:58:55.983146Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T16:59:07.554Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing character casing in a redirect target hostname. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "CWE-178: Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:48:30.548Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-3x7x-24rq-h5j6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-3x7x-24rq-h5j6"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/pull/42092",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42092"
},
{
"name": "https://github.com/discourse/discourse/pull/42093",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42093"
},
{
"name": "https://github.com/discourse/discourse/pull/42094",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42094"
},
{
"name": "https://github.com/discourse/discourse/commit/a3e10759fef47f03d450649bb51d9e84f4c68b8f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/a3e10759fef47f03d450649bb51d9e84f4c68b8f"
},
{
"name": "https://github.com/discourse/discourse/commit/c2eb6b0e5597d6f28f4be739b83300bc9c69e3cd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c2eb6b0e5597d6f28f4be739b83300bc9c69e3cd"
},
{
"name": "https://github.com/discourse/discourse/commit/caa615c371b1696982ee11ac8f3558f0f8ced584",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/caa615c371b1696982ee11ac8f3558f0f8ced584"
},
{
"name": "https://github.com/discourse/discourse/commit/f503971d311b7b0dfdb751ee8cfd67e8cb99f5c5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/f503971d311b7b0dfdb751ee8cfd67e8cb99f5c5"
}
],
"source": {
"advisory": "GHSA-3x7x-24rq-h5j6",
"discovery": "UNKNOWN"
},
"title": "Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72721",
"datePublished": "2026-08-10T15:48:30.548Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T16:59:07.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72720 (GCVE-0-2026-72720)
Vulnerability from cvelistv5 – Published: 2026-08-10 15:41 – Updated: 2026-08-10 15:41
VLAI
EPSS
VEX
Title
Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values can cause decoded attribute text to be reinterpreted as HTML. The vulnerable conversion also fails to strictly validate the Vimeo iframe host and path, allowing non-Vimeo allowlisted iframes to be converted. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.
Severity
6.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42244 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42245 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42246 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42247 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/234… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/4b6… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/a5d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/b25… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.7"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.2"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.1"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.0-latest.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values can cause decoded attribute text to be reinterpreted as HTML. The vulnerable conversion also fails to strictly validate the Vimeo iframe host and path, allowing non-Vimeo allowlisted iframes to be converted. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:41:51.764Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-3q6f-6gm9-m35v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-3q6f-6gm9-m35v"
},
{
"name": "https://github.com/discourse/discourse/pull/42244",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42244"
},
{
"name": "https://github.com/discourse/discourse/pull/42245",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42245"
},
{
"name": "https://github.com/discourse/discourse/pull/42246",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42246"
},
{
"name": "https://github.com/discourse/discourse/pull/42247",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42247"
},
{
"name": "https://github.com/discourse/discourse/commit/234ee88a5b9b53bf938c53351eab20130323485f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/234ee88a5b9b53bf938c53351eab20130323485f"
},
{
"name": "https://github.com/discourse/discourse/commit/4b639a52f47fb3d46093bece9df147e4e9517a11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/4b639a52f47fb3d46093bece9df147e4e9517a11"
},
{
"name": "https://github.com/discourse/discourse/commit/a5d3b112d598242c1d1803d5a77bf98d5fdabd75",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/a5d3b112d598242c1d1803d5a77bf98d5fdabd75"
},
{
"name": "https://github.com/discourse/discourse/commit/b25a074b165253e01fc4c8911b980fc68338ea16",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/b25a074b165253e01fc4c8911b980fc68338ea16"
}
],
"source": {
"advisory": "GHSA-3q6f-6gm9-m35v",
"discovery": "UNKNOWN"
},
"title": "Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72720",
"datePublished": "2026-08-10T15:41:51.764Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T15:41:51.764Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}