A cross-site scripting vulnerability in Discourse allows authenticated attackers to execute arbitrary scripts in the context of other users, potentially leading to account takeover.

This is a cross-site scripting (XSS) vulnerability resulting from the improper neutralization of user-supplied input during web page generation. An authenticated user can leverage this to trigger malicious scripts against other users.

With a CVSS score of 8.7, this vulnerability poses a high risk to user integrity and session security. Successful exploitation could allow attackers to hijack user sessions, steal sensitive information, or perform unauthorized actions on behalf of victims, damaging user trust and platform integrity.

Immediate Action: Update Discourse to the latest patched releases: 2026.1.6, 2026.5.2, or 2026.6.1.

Proactive Monitoring: Review application logs for suspicious script injections or unusual client-side behavior patterns within the discussion platform.

Compensating Controls: Utilize a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and mitigate the impact of stored or reflected XSS.

Public Exploit Available: No (exploit_available: false)

Given the potential for session hijacking and unauthorized user activity, organizations should prioritize updating their Discourse instances to the specified patched versions.