Vulnerability Details CVE-2026-53963
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 36.3%
CVSS Severity
CVSS v3 Score 7.3
References
- https://github.com/discourse/discourse/commit/40de62cddadc65c328a1028ab999f3fa94adbfed
- https://github.com/discourse/discourse/commit/529e17d4d570a48972e7cf64720e5dd1fdf23ca8
- https://github.com/discourse/discourse/commit/d92973e51a46cf6dd20c71e6068e6769b67eea5b
- https://github.com/discourse/discourse/commit/daea5214d833eacbdd3b1a78d99eb14e9cabd915
- https://github.com/discourse/discourse/releases/tag/v2026.1.5
- https://github.com/discourse/discourse/releases/tag/v2026.4.2
- https://github.com/discourse/discourse/releases/tag/v2026.5.1
- https://github.com/discourse/discourse/releases/tag/v2026.6.0
- https://github.com/discourse/discourse/security/advisories/GHSA-wg5x-7f23-m3r5
Products affected by CVE-2026-53963
-
cpe:2.3:a:discourse:discourse:2026.1.0
-
cpe:2.3:a:discourse:discourse:2026.1.1
-
cpe:2.3:a:discourse:discourse:2026.1.2
-
cpe:2.3:a:discourse:discourse:2026.1.3
-
cpe:2.3:a:discourse:discourse:2026.1.4
-
cpe:2.3:a:discourse:discourse:2026.4.0
-
cpe:2.3:a:discourse:discourse:2026.4.1
-
cpe:2.3:a:discourse:discourse:2026.6.0