CVE Catalog
CVE-2026-72730
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk0.24%
15th percentile - higher than 15% of all known CVEs
Summary
Discourse has a stored XSS vulnerability in the rich text editor, where a chat-transcript username is rendered as HTML.
Risk Assessment
An attacker can inject a malicious script that executes in other users' browsers, potentially leading to session or data theft.
Recommendation
Update Discourse to versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, which include the fix.
Original NVD description (English source)
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.