The vulnerability stems from the staff action log model rendering previous and new value fields without proper escaping, allowing injected HTML or script content to be stored and later executed within the staff UI. This stored XSS can lead to session hijacking, credential theft, or arbitrary code execution in the browser context of any staff member who views the affected logs.

Discourse users running versions earlier than 2026.1.6 are impacted. The issue is addressed in releases 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. All instances of the Discourse platform, regardless of deployment size, should be assessed against these version thresholds.

The reported CVSS score of 5.4 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector requires an attacker to have staff‑level access capable of creating or modifying action log entries. Once malicious content is stored, any staff member who views the affected logs will have the injected script executed in their browser, potentially compromising the entire staff session. The risk is confined to staff interfaces and does not automatically extend to general users or the public forum pages.