SB2026080103 - Multiple vulnerabilities in Discourse
Published: August 1, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) SQL injection (CVE-ID: N/A)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to SQL injection in the Data Explorer parameter interpolation logic when processing parameterized queries. A remote user can supply crafted parameter values to disclose sensitive information.
Queries execute in a read-only transaction, so database contents can be read but not modified.
2) Improper access control (CVE-ID: N/A)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to embed malicious content in a site.
The vulnerability exists due to improper access control in the Onebox allowlist when processing specially-formed URLs. A remote user can supply a specially crafted URL to embed malicious content in a site.
3) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to inject arbitrary HTML.
The vulnerability exists due to improper neutralization of special elements in PrettyText.format_for_email when reparsing cooked attribute values as markup. A remote user can supply crafted attribute content to inject arbitrary HTML.
The issue involves cooked attribute text being decoded and then reinterpreted as HTML during email formatting.
Remediation
Install update from vendor's website.