What is the CVSS score of CVE-2026-53963?

CVE-2026-53963 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Discourse are affected by CVE-2026-53963?

Discourse discussion platforms are vulnerable to an attack through the 2FA configuration process that allows unauthorized users to compromise administrator accounts and gain complete platform…. A patch is available.

How to fix or mitigate CVE-2026-53963?

Within 24 hours, inventory all Discourse installations and identify those running versions 2026.1.x through 2026.6.x before the fixed releases. Within 7 days, apply the vendor-released patch by upgrading to Discourse version 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 or later, based on your current release line. Within 30 days, audit 2FA authenticator name configurations for suspicious entries, review administrator impersonation logs for exploitation indicators, and verify successful patch deployment across all instances.

Discourse CVE-2026-53963

EUVD-2026-42738 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-09 security-advisories@github.com

XSS Discourse

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Attacker needs only a normal account (PR:L) but relies on an admin impersonation action (UI:R); XSS crosses into the admin's higher-authority session (S:C) with full impact on that context.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 01:44 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 14, 2026 - 01:43 vuln.today

Analysis Updated

Jul 14, 2026 - 01:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 01:37 vuln.today

cvss_changed

Severity Changed

Jul 14, 2026 - 01:37 NVD

HIGH CRITICAL

CVSS changed

Jul 14, 2026 - 01:37 NVD

7.3 (HIGH) 9.0 (CRITICAL)

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:33 vuln.today

DescriptionNVD

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

AnalysisAI

Stored cross-site scripting in the Discourse discussion platform allows a low-privileged registered user to set a malicious two-factor authenticator name that executes JavaScript in an administrator's browser when that admin impersonates the account and opens the 2FA delete confirmation dialog. Affected builds are Discourse before 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, spanning the 2026.1.x through 2026.6.x release lines. There is no public exploit identified at time of analysis and the EPSS probability is low (0.39%), but the fix commit's regression test reveals the exact working payload, and successful exploitation runs in a full-admin context.

Technical ContextAI

The affected component is Discourse, a Ruby/Ember open-source community forum platform (CPE cpe:2.3:a:discourse:discourse). The root cause is CWE-79 (improper neutralization of input during web page generation): the Ember frontend controller preferences/second-factor.js interpolated the user-supplied second-factor method name directly into the delete confirmation dialog without HTML escaping. The upstream fix (commit 40de62cd and related 529e17d4, d92973e5, daea5214) wraps the value with escapeExpression(secondFactorMethod.name) from discourse/lib/utilities, converting the name to inert text. Because the 2FA name is attacker-controlled and persisted server-side, this is a stored (persistent) XSS rather than reflected, and it fires in the DOM of whichever session renders the dialog - here, an impersonating administrator.

RemediationAI

Vendor-released patch: upgrade to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5, whichever matches your release branch (release notes at https://github.com/discourse/discourse/releases/tag/v2026.6.0, /v2026.5.1, /v2026.4.2, and /v2026.1.5; fix commit 40de62cddadc65c328a1028ab999f3fa94adbfed). The patch simply HTML-escapes the second-factor name in the delete dialog and has no functional side effects, so it should be applied without hesitation. If an immediate upgrade is not possible, the concrete compensating control is to avoid using the administrator impersonation feature (Admin > Users > Impersonate) - since exploitation requires an admin to impersonate the attacker's account and open the 2FA delete confirmation, refraining from impersonating untrusted or suspicious accounts fully breaks the attack chain; the trade-off is loss of impersonation-based support workflows. Reviewing accounts for 2FA method names containing HTML/script markup can also surface planted payloads before they are triggered.