The vulnerability allows a malicious account to embed arbitrary HTML into its full name, which is rendered without sanitization when the user posts are viewed. When an editor modifies a post belonging to that account, the unsanitized HTML is injected into all browsers viewing the edited post, enabling attackers to steal session cookies, deface content, or execute additional client‑side scripts. This is a classic Cross‑Site Scripting flaw (CWE‑79).

Discourse, the open‑source discussion platform, is impacted in all releases older than 2025.12.2, 2026.1.1, and 2026.2.0. The defect manifests only when the settings `display_name_on_posts` is true and `prioritize_username_in_ux` is false, causing raw user names to be output as raw HTML. Any installation running a vulnerable version with these settings should be considered at risk.

The CVSS base score is 1.3, indicating a low severity, and the EPSS probability is below 1 %, reflecting a very low chance of exploitation. The vulnerability is not listed in CISA’s KEV catalog. It is inferred that exploitation requires an authenticated user with permission to edit posts, and the effect is limited to browsers that render the malicious user name from posts edited by the attacker. Consequently, while the overall risk remains low, any publicly exposed Discourse instance with the problematic settings may still be exposed to XSS attacks.