Stored XSS Vulnerability in Discourse Discussion Platform
CVE-2026-33411

5.4MEDIUM

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
20 March 2026

What is CVE-2026-33411?

The Discourse discussion platform has a vulnerability that allows for potential stored cross-site scripting (XSS) attacks through topic titles in the solved posts stream. This affects versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. It is recommended to update to the patched versions to mitigate this risk. Users should also ensure that their Content Security Policy is enabled and configured correctly to further protect against XSS threats.

Affected Version(s)

discourse >= 2026.1.0-latest, < 2026.1.2 < 2026.1.0-latest, 2026.1.2

discourse >= 2026.2.0-latest, < 2026.2.1 < 2026.2.0-latest, 2026.2.1

discourse = 2026.3.0-latest = 2026.3.0-latest

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.