CVE-2026-55674
Received Received - Intake

XSS Vulnerability in Discourse via Color Scheme Cookie

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse's nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors' browsers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-55674
EUVD
EUVD-2026-60236

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
discourse discourse to 2026.1.6 (exc)
discourse discourse to 2026.5.0 (exc)
discourse discourse to 2026.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55674 is a critical vulnerability in Discourse where an unauthenticated attacker can inject arbitrary HTML into a page by sending a crafted cookie with a malicious color_scheme_id or dark_scheme_id value. The injected HTML bypasses Discourse's Content Security Policy, allowing arbitrary JavaScript execution in visitors' browsers.

Detection Guidance

Check Discourse version with: grep -r "version" /var/www/discourse/config/app.yml. Vulnerable versions are 2026.6.0-latest, 2026.5.0-latest, and 2026.1.0-latest, or any before 2026.6.0.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in visitors' browsers, potentially leading to session or credential theft, redirection, phishing, or full client-side compromise. The impact is persistent as poisoned responses are cached and served to subsequent users.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, session hijacking, or credential theft due to arbitrary JavaScript execution. This may violate GDPR's data protection requirements (e.g., Article 32 on security of processing) and HIPAA's safeguards for protected health information (e.g., Security Rule requirements for integrity and confidentiality).

Mitigation Strategies

Upgrade Discourse to patched versions 2026.7.0, 2026.6.1, 2026.5.2, or 2026.1.6 immediately. No official workarounds exist; patching is required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55674. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart