CVE-2026-72727 in Discourse

Riassunto

di MITRE • 10/08/2026

Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsabile: GitHub M
• Prenotare: 10/08/2026
• Divulgazione: 10/08/2026
• Moderazione: accettato
• Voce: VDB-387777
• CPE: pronto
• CWE: CWE-79 (confermato)
• CVSS: 3.5 (VulDB)
• EPSS: 0.00000
• KEV: no
• Attività: basso
• Settore: Police, Telecommunication, ...

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-72727
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72727
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-72727/