CVE-2026-72727 in Discourse
Summary
by MITRE • 08/10/2026
Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability affects Discourse, an open-source discussion platform that serves as a collaborative forum for communities and organizations. The security flaw represents a stored cross-site scripting vulnerability that allows low-privileged users to inject malicious content into the moderation review queue system. The vulnerability specifically targets environments where sites have modified or disabled default Content Security Policy configurations, creating an attack surface that enables persistent XSS execution when moderators view the compromised content.
The technical implementation of this vulnerability stems from insufficient input sanitization and output encoding within Discourse's moderation queue handling mechanisms. When users with minimal privileges submit content containing crafted malicious scripts, these payloads are stored in the system without proper validation or sanitization. The vulnerability becomes exploitable when a moderator accesses the review queue, as the platform fails to adequately escape or filter the stored content before rendering it in the browser context of the privileged user.
The operational impact of this vulnerability extends beyond simple XSS execution, as it provides attackers with a vector for privilege escalation and session hijacking within the targeted Discourse environment. Moderators who view the malicious content in the review queue become victims of the stored XSS attack, potentially allowing attackers to execute arbitrary JavaScript code in their browser context. This could lead to unauthorized access to moderation functions, data exfiltration, or further exploitation of the compromised administrator sessions.
This vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, which specifically addresses cross-site scripting flaws in web applications. The issue also maps to ATT&CK technique T1566.001: Phishing via Social Engineering, as it relies on users viewing malicious content within a trusted platform interface. Additionally, the vulnerability demonstrates characteristics of T1071.001: Application Layer Protocol: Web Protocols in how it exploits web application communication channels.
The recommended mitigation strategy involves upgrading to the patched versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 which implement proper input validation and output encoding for content stored in moderation queues. Organizations should also enforce strict Content Security Policy configurations that prevent script execution from untrusted sources. Additional defensive measures include implementing regular security auditing of user-submitted content and establishing monitoring procedures for unusual activity within moderation systems. The vulnerability demonstrates the critical importance of validating and sanitizing all user inputs, particularly in privileged system interfaces where the impact of successful exploitation can be severe.