CyberRota Analysis
AI-GeneratedThe vulnerability affects the Discourse open-source discussion platform, where a maliciously crafted second factor name on an attacker-controlled account can lead to stored cross-site scripting (XSS) when an administrator attempts to impersonate that account. This could allow an attacker to execute arbitrary scripts in the context of the administrator's session, potentially compromising sensitive data or system integrity. Organizations using affected versions should prioritize upgrading to the patched releases (2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5) to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)