CVE-2026-72725: Discourse Platform Stored XSS Vulnerability

CVE-2026-72725 Overview

CVE-2026-72725 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Discourse, an open-source discussion platform. The staff-action-log model rendered the previous_value and new_value fields without HTML escaping, allowing an authenticated attacker to inject persistent script payloads into the staff administration interface. When a staff member views the affected log entry, the injected script executes in their browser session under the staff user context.

Critical Impact
Authenticated attackers can inject stored JavaScript into the Discourse staff interface, enabling session hijacking, forced administrative actions, and privilege abuse against moderators and administrators.

Affected Products

Discourse versions prior to 2026.1.6
Discourse 2026.5.x prior to 2026.5.2
Discourse 2026.6.x prior to 2026.6.1

Discovery Timeline

2026-08-10 - CVE-2026-72725 published to the National Vulnerability Database
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72725

Vulnerability Analysis

The vulnerability resides in the client-side rendering logic of the staff action log model (frontend/discourse/admin/models/staff-action-log.js). Discourse records administrative actions such as setting changes, user modifications, and permission updates, capturing the previous_value and new_value for each change. These values were passed to the format() helper with a third argument of false, which disabled HTML escaping and treated the stored content as raw HTML.

An attacker with the ability to trigger a logged staff action, such as modifying a profile field or updating a setting whose value they control, can persist a malicious payload. When any staff member later reviews the log, the payload renders in the Document Object Model (DOM) and executes JavaScript in the context of the Discourse administration UI.

Root Cause

The root cause is missing output encoding on user-influenced data displayed inside a privileged UI surface. The staff action log format calls explicitly opted out of the default escaping behavior by passing false as the escape parameter, violating the principle of contextual output encoding for untrusted input.

Attack Vector

Exploitation requires an authenticated account able to trigger a staff-logged action containing attacker-controlled data. User interaction from a staff member is required to view the log entry. The scope changes because script execution occurs in the privileged staff UI, allowing the attacker to perform actions on behalf of the victim administrator.

javascript

// Security patch in frontend/discourse/admin/models/staff-action-log.js
// The vulnerable calls passed `false` as the third argument to format(),
// which disabled HTML escaping. The fix removes that argument so values
// are escaped by default.

    if (!this.useCustomModalForDetails) {
+      lines.push(format("admin.logs.staff_actions.new_value", this.new_value));
       lines.push(
-        format("admin.logs.staff_actions.new_value", this.new_value, false)
-      );
-      lines.push(
-        format(
-          "admin.logs.staff_actions.previous_value",
-          this.previous_value,
-          false
-        )
+        format("admin.logs.staff_actions.previous_value", this.previous_value)
       );
     }
// Source: https://github.com/discourse/discourse/commit/fd44510b4303e7f8f0b42bd070a2d42d3cda259f

Detection Methods for CVE-2026-72725

Indicators of Compromise

Staff action log entries containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...> in the previous_value or new_value fields.
Unexpected outbound requests originating from staff browser sessions while viewing /admin/logs/staff_action_logs.
Newly created administrator or moderator accounts, API keys, or permission changes that correlate with staff log views.

Detection Strategies

Query the user_histories table (or exported staff action logs) for entries whose value columns contain angle brackets, event handler attributes, or JavaScript URI schemes.
Review web server access logs for staff sessions retrieving /admin/logs/staff_action_logs.json followed by anomalous administrative API calls from the same session.
Compare Discourse version banners against the fixed releases 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 to identify unpatched instances.

Monitoring Recommendations

Alert on Content Security Policy (CSP) violation reports emitted by the Discourse admin interface.
Monitor administrative privilege changes and API key creation events for correlation with staff log activity.
Enable audit logging on the reverse proxy in front of Discourse to retain full request bodies for staff endpoints.

How to Mitigate CVE-2026-72725

Immediate Actions Required

Upgrade Discourse to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 depending on the branch in use.
Audit existing staff action log entries for stored HTML or script payloads and sanitize or purge affected rows.
Rotate administrator sessions and API keys if injected payloads are found in historical logs.

Patch Information

The fix removes the false escape-disable flag from the format() calls in staff-action-log.js, restoring default HTML escaping. Details are available in the Discourse GHSA-8x29-vv56-wj6v Security Advisory and the upstream commit fd44510b.

Workarounds

Restrict access to the staff action log interface to a minimal set of trusted administrators until the patch is applied.
Deploy a strict Content Security Policy that disallows inline scripts on /admin/* routes to reduce exploitability.
Place a web application firewall (WAF) rule in front of Discourse that blocks requests containing HTML tags in fields that feed staff action logs.

bash

# Example: verify installed Discourse version against fixed releases
cd /var/discourse
./launcher logs app | grep -i "Discourse version"

# Upgrade to a patched release
git -C /var/discourse pull
./launcher rebuild app