CVE-2026-72731
HighCVSS 7.1Summary
Discourse has an SQL injection vulnerability in the Data Explorer plugin, allowing arbitrary SQL execution via query parameters, even by unprivileged users.
Risk Assessment
An attacker can read any table in the database, potentially leading to exposure of sensitive information, although data cannot be modified.
Recommendation
Update Discourse to versions 2026.1.7, 2026.6.2, 2026.7.1, or 2026.8.0-latest.1, which include the fix.
Original NVD description (English source)
Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.