Stored XSS in Discourse Due to Unescaped Second Factor Name

Detection Guidance

This vulnerability is a stored cross-site scripting (XSS) issue in the two-factor authentication (2FA) delete confirmation dialog of Discourse. Detection involves identifying if any attacker-controlled 2FA method names contain malicious scripts that could execute when an administrator impersonates that account.

Since the vulnerability is related to malicious script injection in the 2FA method name, detection can be done by inspecting the 2FA method names stored in the Discourse database for suspicious or script-like content.

There are no specific commands provided in the resources, but a general approach would be to query the database for 2FA method names containing suspicious HTML or JavaScript code patterns such as <script> tags or event handlers.

• Use SQL queries on the Discourse database to search for suspicious 2FA method names, for example: SELECT * FROM two_factor_methods WHERE name LIKE '%<script>%';
• Review logs or UI interactions where administrators impersonate users and attempt to delete 2FA methods, monitoring for unexpected script execution or errors.

As a mitigation, enabling Content Security Policy (CSP) that blocks inline JavaScript can help reduce risk until the system is patched.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows stored cross-site scripting (XSS) when an administrator impersonates an attacker-controlled account, potentially leading to unauthorized access or manipulation of sensitive information.

Such security issues can impact compliance with standards like GDPR and HIPAA, which require protection of personal data and secure system access to prevent data breaches and unauthorized actions.

Failure to address this vulnerability could result in violations of these regulations due to compromised confidentiality and integrity of user data.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Discourse open-source discussion platform prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. It involves a stored cross-site scripting (XSS) issue where a malicious second factor name on an attacker-controlled account was not properly escaped in the delete confirmation dialog. This flaw could be triggered when an administrator impersonated the attacker-controlled account, allowing the execution of malicious scripts.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to stored cross-site scripting attacks, which may allow an attacker to execute arbitrary scripts in the context of an administrator's browser session. This can result in the compromise of administrative privileges, unauthorized actions, or theft of sensitive information accessible to the administrator.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Discourse installation to one of the fixed versions: 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5.

Useful 0 Not Useful 0