What is the CVSS score of CVE-2026-72730?

CVE-2026-72730 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Discourse are affected by CVE-2026-72730?

A stored cross-site scripting vulnerability in Discourse's Chat plugin enables authenticated users to inject malicious code that executes when other users-particularly administrators and…. A patch is available.

How to fix or mitigate CVE-2026-72730?

Within 24 hours, conduct an inventory of all Discourse instances running the Chat plugin and document current version numbers. Within 7 days, upgrade all affected instances to one of the patched versions: Discourse 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 depending on your active release branch. Within 30 days, review chat transcript access logs for administrator and moderator activity around the time this vulnerability was discovered, reset credentials for any accounts showing suspicious session behavior, and implement additional logging controls around sensitive chat transcript access.

Discourse CVE-2026-72730

EUVD-2026-55670 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-10 GitHub_M

XSS Discourse

8.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

PR:L for authenticated-only injection; S:C and C:H/I:H reflect victim browser session takeover; A:N as no service disruption results.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 16:51 vuln.today

Analysis Generated

Aug 10, 2026 - 16:51 vuln.today

CVE Published

Aug 10, 2026 - 16:17 cve.org

HIGH 8.7

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

AnalysisAI

Stored cross-site scripting in Discourse's Chat plugin allows an authenticated user to inject arbitrary HTML and JavaScript into any viewer's browser session by embedding a malicious payload in the username field of a chat-transcript quote block. The Rich Text Editor rendered the username attribute via innerHTML without sanitization, meaning any authenticated Discourse member with chat access could craft a quote block that executes attacker-controlled script when a victim - potentially a moderator or administrator - views the transcript. Patch versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are confirmed released; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

Discourse is an open-source Ruby on Rails discussion platform with a ProseMirror-based Rich Text Editor. The flaw lives in plugins/chat/assets/javascripts/lib/rich-editor-extension.js, where the chat-transcript node renderer constructed DOM content using userElement.innerHTML = '<span ...>${node.attrs.username}</span>', inserting the unsanitized username attribute from a BBCode-style [chat quote] block directly into the DOM as HTML markup. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) describes this class precisely: user-supplied data flows into a sink that parses it as HTML rather than text. The fix, confirmed in commit 32920affe4ad97b461ca2ae2f664c5fefc374baf, replaces innerHTML assignment with individual document.createElement calls using textContent, ensuring the username is treated as a plain text node and never parsed by the HTML engine. The CPE cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* covers all Discourse releases prior to the patched versions.

RemediationAI

Upgrade to one of the patched Discourse releases: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, as confirmed by the vendor advisory at https://github.com/discourse/discourse/security/advisories/GHSA-wg48-qxjc-f459 and the associated commits (32920affe4ad97b461ca2ae2f664c5fefc374baf, 3fb1e8ead0d4f48d2cf55c8110825c7e8a6a45f5, 7eb35d076ab9b6a612e86182336ce9787ce402ea, 9633b8ecaf5a99f0407f5261b9bd1a05f7dac529). If immediate patching is not possible, administrators can disable the Chat plugin entirely as a compensating control - this eliminates the vulnerable code path but removes all chat functionality from the platform. Restricting chat access to a minimal set of highly trusted users reduces the attacker pool but does not eliminate the vulnerability. There is no configuration toggle that preserves Chat functionality while blocking this specific injection path prior to patching.