CVE-2026-72731 in Discourse
Summary
by MITRE • 08/10/2026
Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in Discourse's Data Explorer plugin represents a critical SQL injection flaw that emerged across multiple versions from 2026.1.0-latest through 2026.8.0-latest.1, affecting the platform's data exploration capabilities and exposing sensitive information to unauthorized users. This security weakness stems from inadequate input validation and parameter handling within the plugin's core components, specifically in the discourse_data_explorer/data_explorer.rb and discourse_data_explorer/workflows/sql_action/v1.rb files where user-supplied parameters were not properly sanitized before being incorporated into database queries.
The technical exploitation of this vulnerability leveraged recursive parameter interpolation mechanisms that allowed attackers to chain parameter values together, creating a cascading effect where one parameter could introduce another through the query execution process. Additionally, the implementation permitted parameter declarations within SQL comments, enabling malicious actors to inject arbitrary SQL statements that would bypass normal input validation checks. This design flaw effectively transformed what should have been controlled parameterized queries into potentially dangerous injection vectors capable of executing unauthorized database operations.
The operational impact of this vulnerability extends beyond simple data exposure, as it granted attackers read access to any table within the database through the Data Explorer's shared query functionality. While the queries executed within read-only transactions prevented modification of data, the ability to extract sensitive information from any accessible database table represents a significant breach of confidentiality and data integrity. Attackers could potentially access user credentials, private messages, forum content, and other sensitive organizational data that might otherwise be protected by standard access controls.
This vulnerability aligns with common security weaknesses catalogued under CWE-89 SQL Injection and CWE-20 Improper Input Validation, demonstrating how recursive parameter handling combined with insufficient sanitization creates exploitable attack surfaces. From an adversarial perspective, this issue maps to ATT&CK technique T1078 Valid Accounts and T1566 Phishing, as unauthorized users could potentially leverage compromised accounts or social engineering to gain access to the Data Explorer functionality. The vulnerability's persistence across multiple version releases indicates a systemic flaw in the plugin's security architecture that required comprehensive code review and validation of parameter handling mechanisms.
Organizations utilizing Discourse should immediately upgrade to the patched versions 2026.1.7, 2026.6.2, 2026.7.1, or 2026.8.0-latest.1 to remediate this vulnerability. Security teams should also implement network-level monitoring to detect unusual Data Explorer query patterns and consider temporary restrictions on shared query access until the upgrade is complete. The fix implemented in these versions addresses both the recursive parameter interpolation issue and the SQL comment handling mechanism, ensuring that all user-supplied parameters are properly escaped and validated before database execution.