Which versions of Discourse are affected by CVE-2026-55424?

A stored cross-site scripting vulnerability in Discourse (CVE-2026-55424) affects community platforms that have modified their default Content Security Policy, risking exposure of member accounts and…. A patch is available.

How to fix or mitigate CVE-2026-55424?

Within 24 hours: audit your Discourse instance's Content Security Policy configuration to confirm XSS protections are enabled and not custom-weakened. Within 7 days: upgrade to patched versions (2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 depending on release branch). Within 30 days: review audit logs for featured topic links created prior to patching.

Discourse CVE-2026-55424

Q: What is the CVSS score of CVE-2026-55424?

CVE-2026-55424 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-42733 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-09 security-advisories@github.com

XSS Discourse

7.4

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

AC:H and UI:R capture the required non-default weakened-CSP config plus victim viewing the list; PR:L for the authenticated featured-link setter; S:C and C/I:L for cross-context script execution in the victim's browser.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:34 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content Security Policy protections were modified or disabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

AnalysisAI

Stored cross-site scripting in Discourse (before 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5) lets a user with permission to set a topic "featured link" inject JavaScript that executes when the link is rendered in the topic list. Exploitation only succeeds where the platform's default Content Security Policy has been weakened or disabled, so out-of-the-box installs are protected in depth. No public exploit identified at time of analysis, and the issue is not in CISA KEV; official fixed releases are available.

Technical ContextAI

Discourse is a widely used open-source Ruby on Rails discussion/forum platform. The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS: the topic "featured link" value is persisted and later echoed into the topic-list view without sufficient normalization and output escaping, allowing a crafted URL/attribute to break out into an executable JavaScript context (e.g., a javascript: URI or injected markup). Discourse ships a hardened default Content Security Policy that blocks inline/script execution, which is why the bug is only exploitable when that CSP is customized away or turned off. No CPE strings were supplied in the input; affected products are identified from the vendor advisory and release tags rather than NVD CPE data.

RemediationAI

Vendor-released patch: upgrade to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 (choose the fixed release on your current branch) per advisory GHSA-695w-7fv8-mxg3; the fix corresponds to commits 1bce8881e4253d9bbab56f011a12ef899b926b59, 6679d9a5083488bae10c2adbb345c481c583242c, 6828aee9b15c2655d63b515ac919830bd540ff83, and c9b9405f5bd0bf0269e505e28e3aad388d7657c5. As the most effective compensating control until you patch, re-enable and stop weakening Discourse's default Content Security Policy, since the CVE is only exploitable when that CSP is modified or disabled - the trade-off is that custom themes/plugins relying on inline scripts or external origins may need CSP allowances rather than a blanket relaxation. Additionally, restrict who can set featured links by tightening the trust level / category permissions required to create or edit topics with featured links, and audit existing featured links for suspicious javascript: or markup payloads; the side effect is reduced convenience for lower-trust users.