Discourse EUVD-2026-55666

Three concrete prerequisites must all be true simultaneously. First, the attacker must hold a valid low-privileged Discourse account (PR:L) - anonymous or unauthenticated users cannot submit content to the moderation queue. Second, the target Discourse instance must have its default Content Security Policy modified or disabled by a site operator - this is a non-default administrative configuration decision; sites running Discourse's default CSP are not exploitable. Third, a moderator must actively open and view the moderation review queue containing the crafted content (UI:A) - exploitation cannot be triggered remotely without this human action. What limits exploitation: the CSP prerequisite alone disqualifies the majority of standard Discourse deployments; the moderator interaction requirement prevents automated or opportunistic mass exploitation.

The CVSS 4.0 score of 4.8 (Medium) accurately reflects a constrained-but-real risk. The vector AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N confirms network reachability with low complexity, but mandates both low-privilege authentication and active moderator interaction, driving the score down significantly from a theoretical maximum. The most important limiting signal is in the CVE description itself: exploitation only succeeds on sites with a modified or disabled default CSP - this is not the default Discourse configuration and substantially narrows the exposed population. No EPSS data was provided in the input. No KEV listing and no public POC have been identified, meaning exploitation status is unconfirmed in the wild. Despite the moderate CVSS score, the realistic priority is elevated for Discourse operators who have customized their CSP, and negligible for those running default configurations.

A registered Discourse user with minimal privileges submits a post or reply containing a crafted stored XSS payload - for example, an obfuscated script tag embedded in content likely to trigger moderator review (e.g., a flagged post). When a moderator opens the review queue on a site where the default CSP has been loosened or removed, the payload executes in the moderator's browser context, potentially harvesting session cookies or CSRF tokens and enabling account takeover or privileged actions on behalf of the moderator. No public POC exists at time of analysis.