Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-10T16:19:49.957Z",
  "pubdate": "2026-08-10T16:19:49.957Z",
  "executiveSummary": "A stored cross-site scripting vulnerability exists within the staff action log model of Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The vulnerability allows malicious actors to inject arbitrary JavaScript payloads through unescaped previous and new value fields. When administrative users or staff members review the staff action logs via the staff interface, the injected scripts execute within the context of their authenticated sessions. This flaw exposes high-privilege administrative interfaces to session hijacking, unauthorized administrative actions, and potential platform compromise. Exploitation requires the capability to generate specific logged actions containing malicious payloads that subsequently render unsanitized data in the web interface. Organizations utilizing vulnerable Discourse instances face significant risk implications due to the potential targeting of privileged accounts.",
  "technicalDetails": "The vulnerability stems from improper output neutralization and inadequate context-aware escaping within the staff action log model of Discourse. Specifically, the previous value and new value fields associated with logged administrative and moderation actions fail to sanitize user-supplied or system-generated inputs before rendering them in the Document Object Model of the staff interface. When an action is recorded that includes malicious markup, the raw payload is stored persistently within the database. During subsequent review operations within the administrative panel, the affected application components output the raw strings directly into the HTML response without applying proper HTML entity encoding or sanitization routines. This lack of validation facilitates stored cross-site scripting attacks. The attack flow commences when an adversary triggers or simulates conditions that record modified previous or new values containing malicious JavaScript payloads into the staff action log. Upon navigation to the staff action log interface by an authenticated administrator or moderator, the browser parses and executes the injected script within the active user session. Because the execution occurs within the administrative interface, the payload inherits elevated privileges, enabling potential execution of privileged API calls, creation of secondary administrative accounts, or extraction of sensitive session tokens. The vulnerability affects Discourse installations prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. Network exposure is constrained to the web interface accessible to authenticated staff members, but the persistence mechanism allows the payload to execute whenever targeted logs are viewed."
}