Discourse CVE-2026-72725

Exploitation requires an authenticated Discourse account (PR:L) with sufficient permissions to perform an action that generates a staff action log entry - for example, a user changing their display name via a change_name action, which is a default capability for regular users. The malicious value must be accepted as previous_value or new_value in the UserHistory model without prior sanitization at write time. A staff member must then actively visit the /admin/logs/staff_action_logs page (UI:R), at which point the stored payload executes. Exploitation is bounded by: the need for any valid Discourse account, the requirement for staff user interaction to trigger execution, and the admin-only visibility of the affected log view. Instances where user profile editing or other logged actions are restricted to trusted members have a significantly reduced attack surface.

The CVSS 5.4 score (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) accurately reflects the constrained exploitation path: a low-privileged authenticated user must be able to trigger a loggable action, and a staff member must subsequently view the action logs. The scope change (S:C) is significant - successful exploitation pivots from a user-context injection to admin browser session compromise, potentially exposing session tokens or enabling admin-level actions. No EPSS data, KEV listing, or POC availability was provided, so exploitation probability cannot be quantified beyond what CVSS signals. Real-world risk is moderate-to-elevated for Discourse instances where moderators or users perform frequently logged actions: the persistence of the payload means it is reliably triggered on routine admin review rather than requiring active attacker presence. The primary limiting factor is PR:L - exploitation is not possible without an account.

An authenticated Discourse user changes their display name to an HTML payload such as <img src=x onerror="alert(document.cookie)">, triggering a UserHistory record with the malicious string stored as new_value. When an administrator next navigates to /admin/logs/staff_action_logs, the unescaped value renders as live HTML in the browser, executing the injected script within the admin's authenticated session context. The commit test case in admin_staff_action_logs_spec.rb demonstrates exactly this payload pattern, confirming exploitability.