What is the CVSS score of CVE-2026-53963?

CVE-2026-53963 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Discourse are affected by CVE-2026-53963?

Discourse discussion platforms are vulnerable to an attack through the 2FA configuration process that allows unauthorized users to compromise administrator accounts and gain complete platform…. A patch is available.

How to fix or mitigate CVE-2026-53963?

Within 24 hours, inventory all Discourse installations and identify those running versions 2026.1.x through 2026.6.x before the fixed releases. Within 7 days, apply the vendor-released patch by upgrading to Discourse version 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 or later, based on your current release line. Within 30 days, audit 2FA authenticator name configurations for suspicious entries, review administrator impersonation logs for exploitation indicators, and verify successful patch deployment across all instances.

Discourse CVE-2026-53963

EUVD-2026-42738 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-09 security-advisories@github.com

XSS Discourse

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Attacker needs only a normal account (PR:L) but relies on an admin impersonation action (UI:R); XSS crosses into the admin's higher-authority session (S:C) with full impact on that context.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 01:44 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 14, 2026 - 01:43 vuln.today

Analysis Updated

Jul 14, 2026 - 01:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 01:37 vuln.today

cvss_changed

Severity Changed

Jul 14, 2026 - 01:37 NVD

HIGH CRITICAL

CVSS changed

Jul 14, 2026 - 01:37 NVD

7.3 (HIGH) 9.0 (CRITICAL)

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:33 vuln.today

DescriptionNVD

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

AnalysisAI

Stored cross-site scripting in the Discourse discussion platform allows a low-privileged registered user to set a malicious two-factor authenticator name that executes JavaScript in an administrator's browser when that admin impersonates the account and opens the 2FA delete confirmation dialog. Affected builds are Discourse before 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, spanning the 2026.1.x through 2026.6.x release lines. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Delivery

Set 2FA name to XSS payload

Exploit

Admin impersonates the account

Execution

Admin opens 2FA delete dialog

Persist

Payload executes in admin browser

Impact

Hijack admin session/privileges

Access

Delivery

Set 2FA name to XSS payload

Exploit

Admin impersonates the account

Execution

Admin opens 2FA delete dialog

Persist

Payload executes in admin browser

Impact

Hijack admin session/privileges

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to hold a controllable Discourse account on which they set a malicious, HTML-bearing second-factor (2FA) method name, and - critically - requires an administrator to (1) use the impersonation feature on that specific account and (2) open the two-factor authenticator delete confirmation dialog, where the unescaped name is rendered. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H = 9.0) drives the critical rating largely through the scope change (S:C) and high triple impact, reflecting that code executes in a high-authority admin session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers or controls an ordinary forum account and adds a TOTP/security-key second factor whose name is an HTML payload such as '<img src=x onerror="window.__xssTriggered=true">'. Later, an administrator investigating that user impersonates the account and opens the second-factor delete confirmation dialog, at which point the payload executes in the admin's authenticated browser session, enabling actions such as CSRF-token theft or admin-privileged API calls. …
Remediation	Vendor-released patch: upgrade to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5, whichever matches your release branch (release notes at https://github.com/discourse/discourse/releases/tag/v2026.6.0, /v2026.5.1, /v2026.4.2, and /v2026.1.5; fix commit 40de62cddadc65c328a1028ab999f3fa94adbfed). … Detailed patch versions, workarounds, and compensating controls in full report.