Executive brief
Discourse's Data Explorer feature allows users to run parameterized SQL queries. A vulnerability in parameter interpolation logic allowed non-staff members to craft malicious parameter values that escape the intended query and execute arbitrary SQL commands. While queries run in read-only mode preventing data modification, attackers could read any table in the database. This could expose sensitive user information, private messages, and other confidential forum data.
Technical details
The vulnerability is a SQL injection flaw in the Data Explorer plugin's parameter handling (discourse_data_explorer/lib/discourse_data_explorer/data_explorer.rb and sql_action/v1.rb). The root cause is inadequate parameter interpolation that suffers from two issues: recursive parameter interpolation allowed one parameter value to introduce another parameter reference, and SQL comment syntax could be used in parameter declarations to inject arbitrary statements. An attacker with ability to run parameterized queries (including non-staff members of groups a query is shared with) could craft parameter values to escape the query context and execute SQL. The vulnerability is network-reachable and requires only query-execution permissions, not authentication as staff. Queries execute in a read-only transaction, limiting impact to data exfiltration rather than modification. The fix involves stripping SQL comments and implementing non-recursive parameter interpolation, as evidenced by the commit references.
Affected products
- Discourse Discourse 2026.1.0 to 2026.1.6, 2026.6.0 to 2026.6.1, 2026.7.0, 2026.8.0-latest.0
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1