Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, when the hidden prioritize_full_name_in_ux site setting is enabled (defaults to false, requires console access to change), user and group display names are rendered without HTML escaping in several assignment-related UI paths. This allows users with assign permission to inject arbitrary HTML/JavaScript that executes in the browser of any user viewing an affected topic. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
References
Configurations
Configuration 1 (hide)
|
History
09 Apr 2026, 19:43
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CPE | cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest.1:*:*:* cpe:2.3:a:discourse:discourse:*:*:*:*:latest:*:*:* cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest:*:*:* |
|
| First Time |
Discourse
Discourse discourse |
|
| References | () https://github.com/discourse/discourse/commit/46edb174e237c6e57bda9c494160da0a174fe70d - Patch | |
| References | () https://github.com/discourse/discourse/security/advisories/GHSA-xg68-q7ff-6gqm - Vendor Advisory |
31 Mar 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-31 18:16
Updated : 2026-04-09 19:43
NVD link : CVE-2026-32607
Mitre link : CVE-2026-32607
CVE.ORG link : CVE-2026-32607
JSON object : View
Products Affected
discourse
- discourse
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')