Is CVE-2026-72731 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72731 being exploited in the wild.

How severe is CVE-2026-72731?

High severity, with a CVSS score of 7.1, published 10 August 2026.

Which products and versions are affected?

Discourse 2026.1.0 to 2026.1.6, 2026.6.0 to 2026.6.1, 2026.7.0, 2026.8.0-latest.0.

Is there a fix for CVE-2026-72731?

A patch was published on 2026-08-10: Fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-72731 attacked?

It is attacked over the network.

Am I affected by CVE-2026-72731?

Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72731: Discourse SQL injection in Data Explorer parameterized queries

CVE-2026-72731 · Severity: high · CVSS 7.1 · Published 2026-08-10

Discourse's Data Explorer feature allows users to run parameterized SQL queries. A vulnerability in parameter interpolation logic allowed non-staff members to craft malicious parameter values that escape the intended query and execute arbitrary SQL commands. While queries run in read-only mode preventing data modification, attackers could read any table in the database. This could expose sensitive user information, private messages, and other confidential forum data.

Technologies: Discourse. Vendors: Discourse.

Quick answers

Is CVE-2026-72731 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72731 being exploited in the wild.
How severe is CVE-2026-72731?: High severity, with a CVSS score of 7.1, published 10 August 2026.
Which products and versions are affected?: Discourse 2026.1.0 to 2026.1.6, 2026.6.0 to 2026.6.1, 2026.7.0, 2026.8.0-latest.0.
Is there a fix for CVE-2026-72731?: A patch was published on 2026-08-10: Fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72731 attacked?: It is attacked over the network.
Am I affected by CVE-2026-72731?: Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a SQL injection flaw in the Data Explorer plugin's parameter handling (discourse_data_explorer/lib/discourse_data_explorer/data_explorer.rb and sql_action/v1.rb). The root cause is inadequate parameter interpolation that suffers from two issues: recursive parameter interpolation allowed one parameter value to introduce another parameter reference, and SQL comment syntax could be used in parameter declarations to inject arbitrary statements. An attacker with ability to run parameterized queries (including non-staff members of groups a query is shared with) could craft parameter values to escape the query context and execute SQL. The vulnerability is network-reachable and requires only query-execution permissions, not authentication as staff. Queries execute in a read-only transaction, limiting impact to data exfiltration rather than modification. The fix involves stripping SQL comments and implementing non-recursive parameter interpolation, as evidenced by the commit references.

Affected products

Discourse Discourse 2026.1.0 to 2026.1.6, 2026.6.0 to 2026.6.1, 2026.7.0, 2026.8.0-latest.0

Timeline

2026-08-10: disclosed
2026-08-10: patched: Fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.