Discourse stores a two‑factor authentication name on each user account. In affected releases, the name appears unescaped in the delete‑confirmation modal when an administrator impersonates that account. The unescaped content is rendered by the browser, allowing malicious scripts to run in the administrator’s browser context. This flaw is a classic reflected or stored cross‑site scripting vulnerability (CWE‑79). The impact is that an attacker who can create a malicious two‑factor name and who has access to an administrative impersonation session can inject and execute client‑side code, potentially compromising admin credentials, session hijacking or defacing the site.

Any Discourse installation running a release before 2026.1.5, 2026.4.2, 2026.5.1 or 2026.6.0 is vulnerable. Administrators with the ability to impersonate users are required to exploit the flaw; therefore, systems enabling admin impersonation are at risk.

The CVSS score of 7.3 indicates a high severity. The EPSS score of less than 1 % demonstrates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an adversary to create a malicious two‑factor name and then let a privileged administrator impersonate that account, making the attack path specialized but feasible where administrator impersonation is enabled. The likely attack vector is via an adm‑admin session that processes the unsanitized modal content.