Junglewise Threat Intelligence

CVE-2026-53963: Discourse stored XSS in 2FA delete confirmation dialog

CVE-2026-53963 · Severity: high · CVSS 7.3 · Published 2026-07-09

Technologies: Discourse. Vendors: Discourse.

Executive brief

Discourse is an open-source platform used for hosting online discussion forums and communities. A security vulnerability exists where a malicious user can name their two-factor authentication (2FA) method with a script that executes when an administrator attempts to manage or delete that user's account. If successful, this could allow an attacker to hijack administrative sessions, potentially leading to unauthorized access to sensitive community data or full control over the forum.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Discourse due to improper neutralization of input in the two-factor authentication (2FA) management interface. Specifically, the name assigned to a second-factor authentication method was not properly escaped when displayed within the delete confirmation dialog. An attacker with a low-privileged account can set a malicious payload as their 2FA device name. The vulnerability is triggered when an administrator impersonates the attacker's account and interacts with the 2FA deletion modal. This could lead to the execution of arbitrary JavaScript in the context of the administrator's session. The issue is resolved in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Affected products

  • Discourse Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0

Timeline

  • 2026-07-09: advisory: GitHub Security Advisory published
  • 2026-07-09: disclosed: NVD publication date

References

Related threats