Discourse XSS in Staff Action Log (before 2026.1.6)
CVE-2026-72725 Published on August 10, 2026
Discourse: Stored XSS in staff action logs injects staff UI
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Vulnerability Analysis
CVE-2026-72725 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-72725 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-72725
Want to know whenever a new CVE is published for Discourse? stack.watch will email you.
Affected Versions
discourse:- Version < 2026.1.6 is affected.
- Version >= 2026.5.0, < 2026.5.2 is affected.
- Version >= 2026.6.0, < 2026.6.1 is affected.