CVE-2026-72727

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0

Description A low-privileged user can submit crafted content to the moderation review queue. This content triggers stored cross-site scripting (XSS)—a technique where malicious scripts are permanently stored on the server and executed in the browser of other users—when viewed by a moderator on sites where the default Content Security Policy (CSP) is disabled or modified.

Recommendations Update to version 2026.1.6 Update to version 2026.5.2 Update to version 2026.6.1 Update to version 2026.7.0