Improper Neutralization of Special Elements Used in a Template Engine in Discourse - #VU166161
Published: November 13, 2026
Vulnerability identifier: #VU166161
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1336
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain administrator privileges and disclose server secrets or other users' data.
The vulnerability exists due to improper neutralization of template elements in Discourse Automation when enabled automations insert user-written text through %%KEY%% or %%REPORT=…%% placeholders and evaluate embedded template tags server-side. A remote user can craft topic titles, posts, profile fields, or report-listed text containing template tags to gain administrator privileges or read sensitive information.
Affected software
Discourse
Remediation
Install security update from vendor's website.
Discourse - addressed in versions 2026.7.5, 2026.9.2, 2026.10.1