Executive brief
Discourse is an open-source discussion platform used to host community forums and conversations. A vulnerability in the staff action log interface allows an attacker to inject malicious scripts that execute in the staff admin panel, potentially compromising administrator accounts and sensitive administrative operations.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the staff action log model, where previous and new value fields are rendered without proper HTML escaping. An attacker can craft payloads that, when logged as part of a staff action, inject arbitrary JavaScript that executes when staff members view the admin interface. The attack does not require network access beyond what is already available to a user capable of triggering staff actions. Patches are available in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Affected products
- Discourse Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0
Timeline
- 2026-08-10: disclosed