What is the CVSS score of EUVD-2026-55671?

EUVD-2026-55671 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Discourse are affected by EUVD-2026-55671?

A SQL injection vulnerability in Discourse's Data Explorer plugin enables any user with query execution permissions to read the entire database, including private messages, user credentials, and API…. A patch is available.

How to fix or mitigate EUVD-2026-55671?

No public exploit identified at time of analysis. Within 24 hours: identify all Discourse instances running the Data Explorer plugin and disable it as emergency containment; initiate a 90-day audit of all queries executed to identify potential unauthorized access. Within 7 days: conduct a comprehensive review of query execution permissions and restrict to essential senior administrators only; audit the database access logs and initiate rotation of all API keys and credentials that may have been exposed. Within 30 days: monitor the Discourse security advisory channel for patch availability; upon release, test the vendor patch in a staging environment and deploy immediately across all instances before re-enabling the plugin.

Discourse EUVD-2026-55671

| CVE-2026-72731 HIGH

SQL Injection (CWE-89)

2026-08-10 GitHub_M

SQLi Discourse

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

6.5 MEDIUM

Read-only transaction enforced at DB level eliminates integrity impact; all other metrics match vendor vector - PR:L reflects mandatory group membership requirement.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 16:51 vuln.today

Analysis Generated

Aug 10, 2026 - 16:51 vuln.today

CVE Published

Aug 10, 2026 - 16:25 cve.org

HIGH 7.1

DescriptionCVE.org

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

AnalysisAI

SQL injection in Discourse's Data Explorer plugin exposes the entire database to unauthorized reads by any user who can execute a shared parameterized query, including non-staff group members. The flaw stems from recursive parameter interpolation: a crafted parameter value could introduce additional parameters, and SQL comment syntax could be used to inject arbitrary statements. Queries execute in a read-only PostgreSQL transaction, so writes are blocked, but every database table - including private messages, user emails, hashed credentials, and API keys - is readable. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.

Technical ContextAI

Discourse's discourse-data-explorer plugin allows staff and shared-group members to run parameterized SQL queries against the application's PostgreSQL database. The vulnerable code in plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb previously used MiniSql::InlineParamEncoder.encode() for bulk parameter substitution with no comment stripping, enabling two distinct injection paths. First, recursive interpolation: because substituted parameter values were re-scanned for additional parameter markers (e.g., :param), an attacker could supply a value like ':other_param' to redirect resolution. Second, comment-based injection: PostgreSQL SQL comments (-- and /* */) in the stored query could contain parameter declarations, and since comments were not stripped before interpolation, a crafted comment could activate injected SQL constructs. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CPE cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* covers all Discourse releases in the affected range. The fix introduced a single-pass strip_comments() function using StringScanner and a new interpolate_params() method that applies gsub exactly once - preventing re-scan of substituted values - and removes SQL comments before interpolation occurs.

RemediationAI

Upgrade Discourse to one of the fixed releases: 2026.1.7, 2026.6.2, 2026.7.1, or 2026.8.0-latest.1, depending on the branch in use. The upstream fix commits are available at https://github.com/discourse/discourse/commit/2bdab888cef561348470dee204a4879d83fbb5c3, https://github.com/discourse/discourse/commit/3dc7f0da7aa18548281152e285244efb1cc8ad0d, https://github.com/discourse/discourse/commit/674ba6fc64184fd7d8e21183c5d8cb22367faa6e, and https://github.com/discourse/discourse/commit/ce9ccf24ec3538172dc8f8199728e08f63e57693. As a compensating control prior to patching, administrators can revoke non-staff group access to all shared Data Explorer queries - this eliminates the untrusted-user attack surface entirely, though it also disables the shared-query feature for those groups. Disabling the discourse-data-explorer plugin entirely is the most complete workaround if query functionality is not business-critical, with the trade-off of losing all Data Explorer reporting capabilities. Because the read-only transaction boundary prevents direct data modification, there is no equivalent network-layer control that blocks the specific injection vectors.