CVE-2026-53963

HIGH

Discourse: Stored-XSS in 2FA delete confirmation modal

Title source: cna
STIX 2.1

Description

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

References (9)

Core 9
Core References

Scores

CVSS v3 7.3
EPSS 0.0039
EPSS Percentile 31.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Details

CWE
CWE-79
Status published
Products (3)
discourse/discourse >= 2026.1.0-latest, < 2026.1.5
discourse/discourse >= 2026.4.0-latest, < 2026.4.2
discourse/discourse >= 2026.5.0-latest, < 2026.5.1
Published Jul 09, 2026
Tracked Since Jul 10, 2026