CVE-2026-32273: Discourse XSS Vulnerability

CVE-2026-32273 Overview

CVE-2026-32273 is a Cross-Site Scripting (XSS) vulnerability affecting Discourse, the popular open-source discussion platform. The vulnerability exists in the API endpoint responsible for updating category descriptions, where input sanitization is not properly applied. This allows authenticated attackers with category management privileges to inject malicious scripts that execute in the context of other users' browsers when viewing the affected category.

Critical Impact

Authenticated attackers can inject malicious JavaScript via unsanitized category description updates, potentially compromising user sessions, stealing credentials, or performing actions on behalf of victims across the Discourse platform.

Affected Products

• Discourse versions 2026.1.0-latest to before 2026.1.3
• Discourse versions 2026.2.0-latest to before 2026.2.2
• Discourse versions 2026.3.0-latest to before 2026.3.0

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-32273 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-32273

Vulnerability Analysis

This XSS vulnerability stems from inadequate input sanitization in the Discourse API when handling category description updates. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a common weakness pattern in web applications where user-supplied data is rendered without proper encoding or validation.

The attack requires network access and low privileges (such as category management permissions), combined with user interaction where a victim must view the affected category page. Due to the changed scope characteristic, a successful exploit can impact resources beyond the vulnerable component itself—specifically, it can affect other users' browsers and sessions within the Discourse platform.

Root Cause

The root cause of this vulnerability lies in the category model's failure to sanitize description strings when they are updated through the API. Unlike the web interface which applies proper sanitization, the API endpoint allowed raw HTML and JavaScript to be persisted in the category description field. When other users subsequently loaded the category page, the unescaped content was rendered directly in their browsers, enabling stored XSS attacks.

Attack Vector

An attacker with category management privileges can craft a malicious API request to update a category's description field with embedded JavaScript code. Since the server-side validation does not sanitize this input, the malicious payload is stored in the database. When any user navigates to the affected category, the stored script executes within their browser session, potentially allowing the attacker to steal session tokens, perform unauthorized actions, or redirect users to phishing sites.

   after_create :delete_category_permalink
   after_update :rename_category_definition, if: :saved_change_to_name?
   after_update :create_category_permalink, if: :saved_change_to_slug?
+  after_update :revise_category_definition, if: :saved_change_to_description?
   after_update :run_plugin_category_update_param_callbacks
   after_destroy :trash_category_definition
   after_destroy :clear_related_site_settings

Source: GitHub Commit Update

The patch adds an after_update callback that triggers revise_category_definition when the description field changes. This ensures that description updates go through the same sanitization process as the web interface, properly escaping any malicious content.

Detection Methods for CVE-2026-32273

Indicators of Compromise

• Unusual category description content containing <script> tags or JavaScript event handlers
• API requests to category update endpoints with HTML/JavaScript payloads in the description field
• Browser-side script execution errors in user access logs when viewing category pages
• Unexpected outbound connections from client browsers when accessing forum categories

Detection Strategies

• Monitor Discourse API logs for PUT/PATCH requests to /categories endpoints containing suspicious HTML patterns
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Review category descriptions in the database for stored XSS payloads using pattern matching
• Deploy web application firewall (WAF) rules to flag requests containing script injection patterns

Monitoring Recommendations

• Enable verbose logging for Discourse API endpoints handling category modifications
• Configure browser security reporting endpoints to capture CSP violation reports
• Set up alerts for abnormal patterns in category update frequency from individual users
• Monitor for session token exfiltration attempts in network traffic logs

How to Mitigate CVE-2026-32273

Immediate Actions Required

• Update Discourse to patched versions 2026.1.3, 2026.2.2, or 2026.3.0 immediately
• Audit existing category descriptions for potential stored XSS payloads
• Review API access logs for suspicious category update requests
• Consider temporarily restricting category management API access to trusted administrators only

Patch Information

The vulnerability has been addressed in Discourse versions 2026.1.3, 2026.2.2, and 2026.3.0. The fix implements proper sanitization for category descriptions updated via API by adding the revise_category_definition callback to the category model's after_update hook when the description field changes. Organizations should update to these patched versions as soon as possible.

For additional details, refer to the GitHub Security Advisory GHSA-h2h4-767x-6pc8 and the commit containing the security fix.

Workarounds

• Implement strict Content Security Policy headers to mitigate XSS impact until patching is possible
• Restrict API access for category management to a limited set of trusted administrators
• Use a reverse proxy or WAF to filter incoming API requests containing script-like patterns in category description fields
• Monitor and audit all category description changes through the admin interface

# Example CSP header configuration for nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.discourse.org; object-src 'none';" always;

# Review category descriptions for XSS payloads
./launcher enter app
rails c
Category.where("description LIKE '%<script%' OR description LIKE '%javascript:%'").pluck(:id, :name, :description)