CVE-2026-72725 in Discourse
Summary
by MITRE • 08/10/2026
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in Discourse prior to version 2026.1.6 represents a critical stored cross-site scripting flaw within the staff action log model that directly impacts the platform's administrative interface security. This issue stems from improper input sanitization where the system fails to adequately escape or filter user-provided data when rendering previous and new value fields in the staff action logs. The vulnerability exists because the application does not implement proper output encoding for data that originates from administrative actions, creating an environment where malicious actors can inject malicious scripts that persist within the system's log records.
The technical implementation of this flaw allows attackers to exploit the lack of input validation and sanitization in the staff action log rendering process. When administrators view the staff action logs, the application directly renders the unescaped values without proper HTML escaping or context-appropriate encoding, which creates a persistent XSS vector. This stored XSS vulnerability is particularly dangerous because it affects the administrative interface where privileged users with elevated permissions are likely to interact with system logs containing malicious payloads. The vulnerability falls under CWE-79 - Improper Neutralization of Input During Web Page Generation, specifically manifesting as stored cross-site scripting due to the persistence of malicious content within the application's data storage.
The operational impact of this vulnerability extends beyond simple script injection, as it provides attackers with potential access to sensitive administrative functions and user data. When administrators view affected log entries, their browsers execute the injected scripts, potentially enabling session hijacking, credential theft, or further privilege escalation attacks. The attack surface is particularly concerning because staff members with administrative privileges are regularly exposed to these logs during routine monitoring activities, making successful exploitation highly probable. This vulnerability directly aligns with ATT&CK technique T1566.002 - Phishing: Spearphishing Attachment, as attackers could craft malicious log entries that would execute when administrators view them, though in this case the attack vector is through legitimate administrative interfaces rather than email attachments.
The remediation implemented in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 addresses the core issue by implementing proper input sanitization and output encoding for all staff action log fields. The fix ensures that any user-provided data within previous and new value fields undergoes appropriate HTML escaping before being rendered in the administrative interface. Organizations should immediately update to these patched versions or implement compensating controls such as web application firewalls, monitoring of staff action logs for suspicious entries, and regular security awareness training for administrative users who interact with system logs containing potentially malicious content.
The vulnerability demonstrates the importance of proper input validation and output encoding in administrative interfaces where privileged users are exposed to potentially untrusted data from various system operations. Security practitioners should consider implementing additional monitoring controls specifically for staff action logs, as these entries often contain sensitive operational information that could be leveraged by attackers. The incident highlights the need for comprehensive security testing of all user-facing administrative components and proper adherence to secure coding practices that prevent injection vulnerabilities in systems handling privileged operations. Organizations maintaining similar discussion platforms should conduct thorough security assessments of their own systems to identify potential cross-site scripting vulnerabilities in administrative interfaces and log rendering components.