What is the CVSS score of EUVD-2026-55664?

EUVD-2026-55664 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-55664?

Yes, a patch is available for EUVD-2026-55664. Update the affected software to the latest version immediately.

Discourse EUVD-2026-55664

| CVE-2026-72725 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-10 GitHub_M

XSS Discourse

5.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS exploitable by any authenticated user (PR:L) targeting admin browser session (S:C, UI:R); no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 16:34 vuln.today

Analysis Generated

Aug 10, 2026 - 16:34 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

AnalysisAI

Stored XSS in Discourse's staff action log interface allows authenticated users to inject malicious HTML into log entries that execute in administrator browser sessions. All Discourse releases prior to 2026.1.6 are affected, with the root cause being an unescaped rendering of previous_value and new_value fields in the admin frontend model. No active exploitation or public exploit code has been identified at time of analysis; vendor-released patches across four stable branches confirm the issue is fully remediated.

Technical ContextAI

The vulnerability exists in frontend/discourse/admin/models/staff-action-log.js, where the format() helper function was invoked with a third argument of false for both new_value and previous_value fields. This false argument explicitly disabled HTML escaping, causing the Ember/Handlebars rendering layer to treat user-supplied log field content as raw HTML rather than plain text. Per CWE-79, this is a stored XSS - the malicious payload persists in the UserHistory database record and is re-executed each time a staff member loads the /admin/logs/staff_action_logs view. The fix, confirmed across three commits, removes the false escape-disabling argument so the format() function applies its default HTML sanitization. The CPE cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* covers all Discourse editions.

RemediationAI

Upgrade Discourse to a patched release: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, as documented in the vendor advisory at https://github.com/discourse/discourse/security/advisories/GHSA-8x29-vv56-wj6v. The fix is implemented across commits 66601a6e, 74ae22d8, and fd44510b. As a compensating control before patching, restrict access to /admin/logs/staff_action_logs to the minimum set of highly trusted administrators, reducing the population of sessions that can trigger payload execution; note this does not prevent malicious content from being written into log records. Additionally, reviewing and enforcing strict Content Security Policy headers may limit the impact of injected scripts, though CSP bypass is not ruled out without further testing.