Description

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-10T17:17:37.663Z",
  "pubdate": "2026-08-10T17:17:37.663Z",
  "executiveSummary": "A SQL injection vulnerability exists in the Discourse Data Explorer plugin, specifically affecting versions 2026.1.0 through 2026.1.6, 2026.6.0 through 2026.6.1, 2026.7.0, and 2026.8.0-latest.0. The vulnerability arises from improper handling of parameterized Data Explorer queries, allowing unauthorized extraction of arbitrary database tables.\nThe flaw stems from recursive parameter interpolation and the misuse of parameter declarations embedded within SQL comments. These mechanisms permit malicious users to escape intended query boundaries and execute arbitrary SQL commands.\nAny user capable of executing a parameterized Data Explorer query—including non-staff members belonging to a group with shared query access—can exploit this vulnerability. Although queries are executed within a read-only transaction preventing data modification, the confidentiality of all database tables is compromised.\nThe risk is significant due to the accessibility of the feature to non-staff group members and the ability to read sensitive data across the entire database. Exploitation requires access to run a shared parameterized query and craft malicious parameter values designed to trigger recursive interpolation.",
  "technicalDetails": "The vulnerability resides within the Discourse Data Explorer plugin, specifically in the source files plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb.\nThe root cause of the vulnerability is insecure parameter interpolation logic. The application processes parameterized queries using recursive parameter interpolation, which fails to adequately sanitize or restrict nested parameter definitions. Additionally, parameter declarations placed inside SQL comments are improperly parsed and evaluated.\nAn attacker exploits this flaw by supplying specially crafted parameter values to a parameterized Data Explorer query. Because of recursive interpolation, a single parameter value is able to dynamically introduce a secondary parameter into the execution context. Concurrently, injected parameter declarations within SQL comments manipulate the query structure.\nThe step-by-step attack flow proceeds as follows: First, an attacker identifies or receives access to a parameterized Data Explorer query shared with a group they belong to, such as a non-staff user group. Second, the attacker crafts malicious input containing nested parameter syntax or SQL comment-based parameter declarations. Third, when the application interpolates the parameters recursively through data_explorer.rb and v1.rb, the injected constructs break out of the parameterized boundary. Finally, the database executes the resulting arbitrary SQL command.\nPrivilege and authentication requirements are limited: the actor must be authenticated and able to run a parameterized Data Explorer query, which includes non-staff members of a group with shared query access. Network exposure encompasses the standard Discourse web application interface where the Data Explorer plugin is enabled.\nRegarding payload behavior and post-exploitation impact, the queries are executed within a read-only database transaction context. Consequently, attackers cannot perform data modification, insertion, or deletion operations. However, the post-exploitation impact allows for the unauthorized reading and enumeration of any table within the database, leading to a complete breach of data confidentiality."
}