Discourse CVE-2026-59830

Requires an authenticated Discourse account (PR:L) capable of setting a display/user name - the attacker must be able to choose a crafted name that gets interpolated into a post action description. Exploitation further requires a victim to view the affected user-activity stream (UI:R), so it is not fully automatable and depends on the attacker's actions surfacing in streams other users browse. Affects default configurations of Discourse prior to 2026.7.0 (no non-default feature toggle is named in the description); the flaw is in the standard post-action-description component, so any instance allowing user-chosen display names is exposed until upgraded.

This is a stored/persistent XSS (CWE-79) in Discourse rated 5.4 (Medium) by the vendor, with the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The signals are mutually consistent and modest: the network attack vector and low complexity are offset by PR:L (an attacker must hold an account able to set a crafted display name) and UI:R (a victim must view the affected user-activity stream). The scope change (S:C) correctly reflects that injected script executes in a different user's browser session, but confidentiality and integrity impact are only Low and availability is unaffected. No EPSS score, no CISA KEV listing, and no standalone weaponized exploit are present in the input, so there is no evidence of active exploitation - the fix commit does ship a regression test demonstrating the payload (<img src=x onerror=alert(1)>), which lowers the bar to reproduce but is not the same as in-the-wild abuse. Net: a legitimate bug worth patching, but a moderate-priority issue rather than an emergency, gated by needing an authenticated account and victim interaction. The source-code diff independently confirms the root cause (unescaped username interpolated into a trustHTML string), which strengthens confidence in the vendor's characterization.

An attacker registers or uses a low-privileged Discourse account and sets a display name containing HTML/script markup (e.g. an img tag with an onerror handler). When that user performs a post action (like, invite, flag) that is rendered in another user's activity stream, the unescaped name is interpolated into HTML passed to trustHTML and executes in the victim's browser. No standalone public exploit is published, but the fix commit includes a regression test that demonstrates the exact payload, making reproduction straightforward.