Discourse EUVD-2026-86302

Requires an authenticated account with default trust-level posting privileges to store the crafted video-placeholder payload. Script execution additionally requires the target Discourse instance to have its Content Security Policy DISABLED or RELAXED - under the default CSP, inline event handlers are blocked and the attack fails to execute. It also requires victim interaction: another user must open the malicious post and click the video play overlay to trigger the injected handler. These three gates (authentication, non-default CSP, and specific victim UI interaction) meaningfully limit realistic exploitation versus the 8.7 base score.

This is a stored XSS (CWE-79) in Discourse's video-placeholder component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7) reflects network reach, low-privilege posting access, and a scope change into the viewer's session, but the score materially overstates real-world risk because it does not weight the single most important limiting factor stated in the description: the default Content Security Policy blocks inline event handlers, so the injected handler does NOT execute on a default-configured instance. Exploitation therefore requires the victim instance to have CSP disabled or relaxed - a non-default hardening regression - plus multi-step victim interaction (open the post AND click the play overlay, UI:R). Given that, AC:L is optimistic and AC:H is more defensible, and C:H/I:H is high for a stored-XSS whose realistic impact is reading page content and issuing authenticated requests as the viewer (C:L/I:L is the conventional call). Exploitation signals are weak: no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis. Net: a legitimate patch-worthy flaw for CSP-relaxed instances, but not an urgent widespread-exploitation priority; default-CSP deployments are not exposed to script execution.

An authenticated user with ordinary trust-level posting rights on a Discourse forum whose CSP has been disabled or relaxed crafts a post containing a video placeholder with a malformed data-video-src that breaks out of the attribute and adds an onerror handler. When a moderator or admin later opens that post and clicks the video play overlay, the handler runs arbitrary JavaScript in their session, reading page content and issuing authenticated requests as the victim. No public exploit code is known, though the fix commit and its regression test disclose the exact breakout payload pattern.