VYPR
patchPublished Aug 17, 2026· Updated Aug 18, 2026· 1 source

Discourse: Critical HTML Injection and Info Disclosure Flaws Disclosed Together

Key findings • Discourse platform affected by four vulnerabilities disclosed on August 17, 2026. • One critical (CVE-2026-55674) and three medium-severity vulnerabilities disclosed. • Vul…

Key findings

  • Discourse platform affected by four vulnerabilities disclosed on August 17, 2026.
  • One critical (CVE-2026-55674) and three medium-severity vulnerabilities disclosed.
  • Vulnerabilities include HTML injection, information disclosure in review queues and shared drafts, and data leakage.
  • Patched versions include 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

On August 17, 2026, a batch of four vulnerabilities was disclosed for the Discourse open-source discussion platform. The disclosures, all occurring within minutes of each other, include one critical and three medium-severity issues. The most severe of these, CVE-2026-55674, is an unauthenticated HTML injection vulnerability that could allow an attacker to inject arbitrary HTML into a Discourse page by sending a single request with a crafted cookie.

The vulnerabilities affect various aspects of the platform:

  • HTML Injection: CVE-2026-55674 allows unauthenticated attackers to inject arbitrary HTML into Discourse pages via a crafted cookie. This issue is present in versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
  • Information Disclosure in Review Queue: CVE-2026-59829, affecting sites with category group moderation enabled, could expose excerpts and permalinks of private messages attached to flags to reviewing category moderators who are not participants in the message. This vulnerability exists in versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1.
  • Information Disclosure in Shared Drafts: CVE-2026-55704 could allow users with limited permissions to view group activity, but not shared drafts, to still receive shared-draft entries through group posts and mentions endpoints. This affects versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
  • Information Leakage in Structured Data: CVE-2026-53960 leaks hidden or unviewable first-post content as an excerpt in the publicly-served Q&A (QAPage) JSON-LD structured data. This exposes the content to unauthenticated visitors and search engine crawlers. This issue is present in versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

All disclosed vulnerabilities are addressed in Discourse versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 (with CVE-2026-59829 also fixed in 2026.7.1). Users are advised to update to these patched versions to mitigate the risks associated with these security flaws. The coordinated disclosure of these vulnerabilities highlights ongoing security efforts for the Discourse platform.

Discourse administrators should prioritize updating their instances to the latest available versions to protect against these newly disclosed vulnerabilities, particularly the critical HTML injection flaw.

The patched versions are: 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 (CVE-2026-59829 also fixed in 2026.7.1).

The critical CVE-2026-55674 allows for arbitrary HTML injection via a crafted cookie.

CVE-2026-59829 could expose private message content in the review queue.

CVE-2026-55704 could lead to the disclosure of shared drafts to unauthorized users.

CVE-2026-53960 leaks hidden post content in public structured data.

Synthesized by Vypr AI