Stored Cross-Site Scripting Vulnerability in Discourse by Discourse
CVE-2026-72727

4.8MEDIUM

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72727?

An issue in Discourse could allow a low-privileged user to inject malicious content into the moderation review queue. When a moderator reviews this content on a site with a customized or disabled default Content Security Policy, it can lead to stored cross-site scripting vulnerabilities. This risk is mitigated in the revised software versions: 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Affected Version(s)

discourse < 2026.1.6 < 2026.1.6

discourse >= 2026.5.0-latest, < 2026.5.2 < 2026.5.0-latest, 2026.5.2

discourse >= 2026.6.0-latest, < 2026.6.1 < 2026.6.0-latest, 2026.6.1

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.