CyberRota Analysis
AI-GeneratedThe staff action log model in Discourse prior to version 2026.1.6 is vulnerable to stored cross-site scripting (XSS) due to unescaped value fields, potentially allowing attackers to inject malicious scripts into the staff interface. This vulnerability poses a medium risk, particularly for organizations using Discourse for community management, as it could lead to unauthorized actions or data exposure. Users should prioritize updating to versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.