CVE-2026-72731
Received Received - Intake

SQL Injection in Discourse Data Explorer Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description
Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72731
EUVD
EUVD-2026-55671

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
discourse discourse From 2026.1.0-latest (inc) to 2026.1.7 (exc)
discourse discourse 2026.1.7
discourse discourse 2026.6.2
discourse discourse 2026.7.1
discourse discourse 2026.8.0-latest.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Discourse allows users with access to parameterized Data Explorer queries to craft parameter values that escape intended queries and execute arbitrary SQL. It affects versions from 2026.1.0 to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1. The issue involves recursive parameter interpolation and SQL comment-based injection, enabling read access to any table without modifying data.

Detection Guidance

Check Discourse versions against affected releases (2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1). Review Data Explorer plugin logs for unusual SQL query patterns or parameter interpolation attempts.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to read sensitive data from any table in the Discourse database. While data modification is not possible due to read-only transactions, exposure of confidential information could lead to privacy breaches or compliance violations.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Discourse to fixed versions (2026.1.7, 2026.6.2, 2026.7.1, or 2026.8.0-latest.1). Restrict access to Data Explorer queries for non-staff users. Monitor for unauthorized SQL query execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72731. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart