CVE-2026-72725
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Discourse prior to version 2026.1.6 rendered previous and new value fields in the staff action log model without escaping, which could inject stored cross-site scripting into the staff interface.
Risk Assessment
Stored XSS in the staff interface may allow an attacker to execute scripts in the context of an administrator session, potentially leading to account takeover or data theft.
Recommendation
Update Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.
Original NVD description (English source)
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.