XSS Vulnerability in Discourse Open-Source Discussion Platform
CVE-2026-32273

5.4MEDIUM

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
31 March 2026

What is CVE-2026-32273?

Discourse, the open-source discussion platform, has identified a vulnerability where the API does not sanitize category description inputs. This oversight allows for potential XSS attacks, enabling malicious users to inject harmful scripts into web pages viewed by others. The vulnerability affects specific versions of the platform and has been remediated in the latest updates. It is crucial for users to update their Discourse installations to the patched versions to mitigate the risk of exploitation.

Affected Version(s)

discourse >= 2026.1.0-latest, < 2026.1.3 < 2026.1.0-latest, 2026.1.3

discourse >= 2026.2.0-latest, < 2026.2.2 < 2026.2.0-latest, 2026.2.2

discourse >= 2026.3.0-latest, < 2026.3.0 < 2026.3.0-latest, 2026.3.0

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/05e3da2a670...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.