Stored XSS in Discourse Staff Action Log

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Discourse, an open-source discussion platform. It occurs because the staff action log model renders unescaped previous and new value fields, allowing malicious scripts to be injected into the staff interface. The issue was fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored cross-site scripting in the staff action log model. Check Discourse admin logs for suspicious entries containing script tags or unusual HTML in previous/new value fields. Look for logs with unexpected content like <script> or onerror= in the staff action log interface.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to inject malicious scripts into the staff interface, potentially stealing session cookies, performing actions on behalf of staff users, or defacing the platform. Users with staff privileges are most at risk, as the injected scripts would execute in their browser context.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to a patched version immediately: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0. If immediate upgrade isn't possible, restrict staff access to the admin interface temporarily and monitor staff action logs for suspicious activity.

Useful 0 Not Useful 0