CVE-2026-72730: Discourse Platform XSS Vulnerability

CVE-2026-72730 Overview

CVE-2026-72730 is a stored cross-site scripting (XSS) vulnerability in Discourse, an open-source discussion platform. The Rich Text Editor rendered a chat-transcript username as HTML rather than as text. An authenticated attacker can craft a username payload that persists in chat transcripts and executes JavaScript in the browser of any user who renders the affected content. The flaw is tracked as [CWE-79] and is fixed in Discourse versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Critical Impact
Attackers can execute arbitrary script in victim browsers, hijack sessions, and pivot privileges through stored payloads embedded in chat-transcript usernames.

Affected Products

Discourse versions prior to 2026.1.6
Discourse versions prior to 2026.5.2
Discourse versions prior to 2026.6.1 and 2026.7.0

Discovery Timeline

2026-08-10 - CVE-2026-72730 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72730

Vulnerability Analysis

The vulnerability resides in the Discourse chat plugin's Rich Text Editor extension, specifically in plugins/chat/assets/javascripts/lib/rich-editor-extension.js. The code constructed a chat-transcript element by assigning a template string containing node.attrs.username directly to innerHTML. Because the username value was interpolated into HTML without escaping, any HTML or script markup contained in the username became part of the live DOM. The result is a stored XSS: the payload is persisted with the chat transcript and executes whenever another user renders the transcript inside the editor.

Root Cause

The root cause is unsafe DOM composition through innerHTML assignment with untrusted input. Discourse trusted the username attribute to be plain text and injected it into an HTML template literal. No output encoding, DOM sanitization, or Content Security Policy enforcement blocked the injection at render time.

Attack Vector

An authenticated user with the ability to influence a username or a chat-transcript node attribute submits a payload containing script content. When another user views a post that embeds the chat transcript in the Rich Text Editor, the payload executes in that user's session context, enabling session theft, forced actions, or privilege escalation against moderators and administrators. Exploitation requires user interaction to view the affected content.

javascript

// Patched code from plugins/chat/assets/javascripts/lib/rich-editor-extension.js
         const formattedDateTime = moment(node.attrs.datetime).format(
           i18n("dates.long_no_year")
         );
-        userElement.innerHTML = `
-          <span class="chat-transcript-username">${node.attrs.username}</span>
-          <span class="chat-transcript-datetime">${formattedDateTime}</span>
-        `;
+        const usernameElement = document.createElement("span");
+        usernameElement.classList.add("chat-transcript-username");
+        usernameElement.textContent = node.attrs.username;
+        userElement.appendChild(usernameElement);
+
+        const datetimeElement = document.createElement("span");
+        datetimeElement.classList.add("chat-transcript-datetime");
+        datetimeElement.textContent = formattedDateTime;
+        userElement.appendChild(datetimeElement);

         const messagesElement = document.createElement("div");
         messagesElement.classList.add("chat-transcript-messages");
// Source: https://github.com/discourse/discourse/commit/32920affe4ad97b461ca2ae2f664c5fefc374baf

The fix replaces innerHTML with document.createElement and textContent, which treats the username as literal text and neutralizes any embedded HTML or script.

Detection Methods for CVE-2026-72730

Indicators of Compromise

Chat transcripts or posts that contain usernames with HTML tags such as <script>, <img onerror=...>, or event-handler attributes.
Unexpected outbound requests from user browsers to attacker-controlled domains immediately after rendering forum content.
Session tokens or CSRF tokens appearing in referer headers or web server logs pointing to external hosts.

Detection Strategies

Review the Discourse database users table and post revisions for username values that contain angle brackets, quotes, or JavaScript URI schemes.
Search Rich Text Editor content and chat-transcript nodes for username attribute values containing HTML markup.
Correlate community moderator or admin session activity with anomalous API calls performed shortly after opening posts containing chat transcripts.

Monitoring Recommendations

Enable and monitor Content Security Policy (CSP) violation reports for inline script executions on the Discourse origin.
Alert on new user registrations whose usernames fail strict alphanumeric validation.
Log and review administrative actions such as role changes, plugin installs, and API key generation for unexpected sequences that could indicate XSS-driven abuse.

How to Mitigate CVE-2026-72730

Immediate Actions Required

Upgrade Discourse to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, matching your maintenance branch.
Rotate administrator and moderator session tokens and API keys after upgrading.
Audit recently created accounts and remove any user records with usernames containing HTML or script content.

Patch Information

The issue is resolved in Discourse versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The upstream fix is available in the GitHub Security Advisory GHSA-wg48-qxjc-f459 and in commits 32920af, 3fb1e8e, 7eb35d0, and 9633b8e. The fix replaces innerHTML assignment with safe DOM APIs that set text content only.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on the Discourse origin.
Temporarily restrict the chat plugin or disable chat-transcript embedding in posts until the upgrade is applied.
Apply strict username validation to reject characters outside a safe alphanumeric set for new registrations and username changes.

bash

# Upgrade a self-hosted Discourse instance to a patched release
cd /var/discourse
git pull
./launcher rebuild app

# Verify the running version matches a patched release
./launcher enter app
cat /var/www/discourse/VERSION
# Expected: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0