Executive brief
Discourse is an open-source discussion platform used by organizations to host forums and communities. An unauthenticated attacker can exploit a vulnerability in how color scheme cookies are processed to inject malicious JavaScript that executes in the browsers of all anonymous visitors. Because the malicious response is cached, a single attack request affects all subsequent anonymous users, enabling credential theft, phishing, account compromise, and full client-side exploitation.
Technical details
This is a stored cross-site scripting (XSS) vulnerability arising from improper output encoding of user-controlled cookie values. The attacker crafts a color_scheme_id or dark_scheme_id cookie containing arbitrary HTML/JavaScript that is rendered into a color scheme tag without HTML escaping. By injecting a closing tag followed by a new script tag, the attacker bypasses Discourse's nonce-based Content Security Policy. Because these cookies were not part of the anonymous cache key, the poisoned HTTP response was cached globally and served to all subsequent anonymous visitors (scoped per User-Agent), converting a single request into a persistent stored XSS. No authentication or user interaction is required to trigger the vulnerability—only that anonymous visitors access the poisoned cached page. Successful exploitation leads to session hijacking, credential theft, phishing redirects, and full browser compromise. The vulnerability is fixed in Discourse versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Affected products
- Discourse Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0
Timeline
- 2026-07-28: disclosed
- 2026-08-17: advisory
- 2026-08-17: patched: Discourse 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0