Discourse, the open‑source forum platform, has a stored cross‑site scripting flaw that allows individuals with post‑assignment rights to inject malicious script into an assignee name. When the hidden configuration prioritize_full_name_in_ux is enabled, the site renders that name without escaping HTML in several assignment‑related user interfaces. A script embedded in the name is executed in the browsers of any user who views the affected topic, enabling actions such as session hijacking, data theft, or content defacement.

The vulnerability affects Discourse releases 2026.1.0 through just before 2026.1.3, 2026.2.0 through just before 2026.2.2, and 2026.3.0 through just before the final 2026.3.0 build. It is present only when the hidden site setting prioritize_full_name_in_ux is set to true. The core application code is impacted; no third‑party plugins are required. The bug was fixed in releases 2026.1.3, 2026.2.2, 2026.3.0 and later.

Severity is low, reflected by a CVSS score of 2.1, and the likelihood of exploitation is very low (under one percent). The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that an attacker has permission to assign a post and that the hidden setting is enabled. If those prerequisites are met, a victim who views the topic will have the injected script executed in their browser, potentially exposing credentials and personal data.