PT-2026-29307 · Discourse · Discourse

Davidtaylorhq · Published 2026-03-31 · Updated 2026-04-07 · CVE-2026-32607

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.3.0

Description Discourse is an open-source discussion platform. When the prioritize full name in ux site setting is enabled, user and group display names are rendered without HTML escaping in assignment-related UI paths. This allows users with assign permission to inject arbitrary HTML/JavaScript that executes in the browser of any user viewing an affected topic.

Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DISCOURSE-2026-32607

CVE-2026-32607

GHSA-XG68-Q7FF-6GQM

Affected Products

Discourse

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32607.json · Exploit
• https://github.com/discourse/discourse/commit/46edb174e237c6e57bda9c494160da0a174fe70d · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-xg68-q7ff-6gqm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32607 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2026-32607 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32607 · Vendor Advisory