CVE-2026-72727
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 allowed a low-privileged user to place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Risk Assessment
An attacker can execute scripts in the moderator's browser, potentially leading to session theft, moderator account takeover, or malicious content distribution.
Recommendation
Update Discourse to one of the fixed versions: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.
Original NVD description (English source)
Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.