Discourse EUVD-2026-42738

Exploitation requires the attacker to hold a controllable Discourse account on which they set a malicious, HTML-bearing second-factor (2FA) method name, and - critically - requires an administrator to (1) use the impersonation feature on that specific account and (2) open the two-factor authenticator delete confirmation dialog, where the unescaped name is rendered. What limits exploitation: the payload only fires within an administrator's session (not against ordinary users), it depends on the discrete admin action of impersonation plus opening the 2FA delete dialog (CVSS UI:R), the attacker must first have a registered account (CVSS PR:L, not unauthenticated), and only unpatched builds below 2026.6.0/2026.5.1/2026.4.2/2026.1.5 are affected. It is not exploitable against default browsing by end users and is not automatable.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H = 9.0) drives the critical rating largely through the scope change (S:C) and high triple impact, reflecting that code executes in a high-authority admin session. However, the signals conflict on real-world urgency: EPSS is only 0.39% (31st percentile), the CVE is NOT in CISA KEV, and there is no public exploit identified, indicating no evidence of active or widespread exploitation. The practical attack path is also narrow - it requires an attacker account (PR:L), plus a specific and non-automatic administrator action (UI:R: impersonate the malicious account AND open the 2FA delete dialog). No SSVC decision record was provided. Net assessment: the raw 9.0 overstates day-to-day exploitation likelihood because of the heavy user-interaction and privilege prerequisites; this is a genuine admin-takeover primitive worth patching promptly on any impersonation-enabled forum, but it is not a mass-exploitable internet-facing bug. Note the C:H/I:H/A:H may be slightly generous for a browser-context XSS, though admin-session compromise plausibly cascades to full instance control.

An attacker registers or controls an ordinary forum account and adds a TOTP/security-key second factor whose name is an HTML payload such as '<img src=x onerror="window.__xssTriggered=true">'. Later, an administrator investigating that user impersonates the account and opens the second-factor delete confirmation dialog, at which point the payload executes in the admin's authenticated browser session, enabling actions such as CSRF-token theft or admin-privileged API calls. No public exploit is identified, but the fix's regression test discloses a functional payload, and the network attack vector with low complexity means weaponization would be straightforward.