CVE-2026-72725

5.4 Moyenne

Publiée le 10/08/2026 à 18:19 · Modifiée le 08/09/2026 à 22:54 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Traduire en français

Produits concernés

discourse

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/discourse/discourse/commit/66601a6e6eeeabfcb06d2f692d68534be12de082
https://github.com/discourse/discourse/commit/74ae22d85f4e13c7c7f2e3c13fce023feec7e033
https://github.com/discourse/discourse/commit/fd44510b4303e7f8f0b42bd070a2d42d3cda259f
https://github.com/discourse/discourse/security/advisories/GHSA-8x29-vv56-wj6v

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories