CVE-2026-32273
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In Discourse, updating a category description via API does not sanitize the description string, which can lead to XSS attacks. This affects versions from 2026.1.0 before 2026.1.3, 2026.2.0 before 2026.2.2, and 2026.3.0 before 2026.3.0.
Risk Assessment
An attacker can inject malicious scripts that execute in the browser of administrators or other users viewing the category, enabling session hijacking or unauthorized actions.
Recommendation
Upgrade Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0.
Original NVD description (English source)
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, updating a category description via API is not sanitizing the description string, which can lead to XSS attacks. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.