Description
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Published: 2026-08-10
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability allows malicious users to embed arbitrary JavaScript within a chat-transcript username that is then rendered as HTML by Discourse's Rich Text Editor. The stored XSS flaw can execute in the browser of any user who views the affected chat transcript, leading to session hijacking, data theft, or defacement. The weakness is a classic input validation flaw described as CWE‑79.

Affected Systems

Discourse installations using the open-source platform before version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 are affected. Updating to any of these patched releases removes the vulnerability.

Risk and Exploitability

The CVSS score of 8.7 reflects high severity. EPSS is unavailable, but the flaw can be exploited remotely through the web interface, as a malicious user can inject code that persists in stored data. The vulnerability is not listed in CISA KEV, but it is still technically exploitable as a web-based stored XSS incident.

Generated by OpenCVE AI on August 10, 2026 at 17:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 to apply the patch that sanitizes chat‑transcript usernames
  • Verify that the Rich Text Editor renders usernames without unescaped HTML after the upgrade
  • If an immediate upgrade is not possible, temporarily disable the chat‑transcript feature or enforce strict sanitization of usernames to prevent script execution

Generated by OpenCVE AI on August 10, 2026 at 17:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
First Time appeared Discourse
Discourse discourse
Vendors & Products Discourse
Discourse discourse

Mon, 10 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 10 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Description Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Title Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'}

Subscriptions

Discourse Discourse
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-10T18:34:18.500Z

Reserved: 2026-08-10T13:48:09.546Z

Link: CVE-2026-72730

cve-icon Vulnrichment

Updated: 2026-08-10T18:34:14.345Z

cve-icon NVD

Status : Received

Published: 2026-08-10T17:17:37.507

Modified: 2026-08-10T19:17:33.807

Link: CVE-2026-72730

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T03:45:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')