SQL Injection Vulnerability in Discourse Discussion Platform
CVE-2026-72731
7.1HIGH
What is CVE-2026-72731?
Discourse, an open-source discussion platform, contains a vulnerability that allows users to exploit parameterized Data Explorer queries. Versions from 2026.1.0-latest to 2026.1.7, along with several others, are affected. Non-staff users can manipulate parameter values that can escape the intended query, executing arbitrary SQL via specific Ruby files. Although the queries are run in a read-only transaction, this flaw exposes sensitive data as it allows access to any readable table without modification capabilities. This issue has been addressed in the latest releases.
Affected Version(s)
discourse < 2026.1.7 < 2026.1.7
discourse >= 2026.6.0-latest, < 2026.6.2 < 2026.6.0-latest, 2026.6.2
discourse >= 2026.7.0-latest, < 2026.7.1 < 2026.7.0-latest, 2026.7.1