CVE-2026-72731

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0-latest through 2026.1.7 Discourse versions 2026.6.0 through 2026.6.2 Discourse versions 2026.7.0 through 2026.7.1 Discourse versions 2026.8.0-latest through 2026.8.0-latest.1

Description Users capable of running parameterized Data Explorer queries, including non-staff members of groups with shared queries, can execute arbitrary SQL. This occurs through plugins/discourse-data-explorer/lib/discourse data explorer/data explorer.rb and plugins/discourse-data-explorer/lib/discourse data explorer/workflows/sql action/v1.rb. The issue is caused by recursive parameter interpolation, where one parameter value can introduce another, and the use of parameter declarations within SQL comments to inject statements. While queries are executed in read-only transactions, preventing data modification, any table can be read.

Recommendations Update to version 2026.1.7 Update to version 2026.6.2 Update to version 2026.7.1 Update to version 2026.8.0-latest.1