Discourse: Critical CSP Bypass Fixed, Three More CVEs

A crafted cookie value, rendered into a Discourse page without escaping, is enough to inject arbitrary HTML and defeat the site’s nonce-based Content Security Policy. No authentication. One request.

CVE-2026-55674 — CVSS 9.3, critical — affects Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The vulnerable input is the color_scheme_id (or dark_scheme_id) cookie. Discourse rendered it into a color scheme tag without sanitizing the value, which allowed attribute-boundary breakout and arbitrary markup injection. According to the GitHub security advisory (GHSA-qx4v-rg4v-pm2g), the injected content bypassed Discourse’s nonce-based Content Security Policy and enabled JavaScript execution.

Nonce-based CSP is the mitigation for exactly this class of attack. A fresh random nonce is embedded in each page’s legitimate script tags; the browser rejects scripts without a matching nonce. The assumption is that even if an attacker can inject into the response body, they can’t produce a valid nonce. CVE-2026-55674 defeated that assumption at the rendering layer — the issue wasn’t the CSP implementation itself, it was that cookie values reached the HTML output without going through a sanitizer first.

Three more in the same batch

Discourse’s coordinated release patches three additional medium-severity information-disclosure CVEs, all fixed in the same version set.

CVE-2026-53960 (CVSS 5.3): Discourse serves QAPage JSON-LD structured data for search engine indexing. Prior to the fix, hidden or otherwise restricted first-post content leaked as plain-text excerpts in that data — accessible to any unauthenticated visitor and indexed by crawlers. If your instance had restricted first posts on public threads, check whether that content has already been indexed.

CVE-2026-55704 (CVSS 4.3): Group members with visibility into group activity — but without explicit shared-draft permission — could retrieve shared-draft topic titles and post excerpts through the group posts and group mentions endpoints. Shared drafts are pre-publication content that shouldn’t be readable outside the drafting team.

CVE-2026-59829 (CVSS 4.3): On Discourse sites with category group moderation enabled, the review queue could include excerpts and permalinks from private messages attached to flags — visible to category moderators who were not participants in those messages. This requires a specific site configuration to be exploitable, but private messages attached to flags often contain sensitive reports.

Affected versions and update targets

Track	Patched version
2026.1.x	2026.1.6
2026.5.x	2026.5.2
2026.6.x	2026.6.1
2026.7.x	2026.7.0

Standard Docker installs update via ./launcher rebuild app. Verify your installed version in Admin → Dashboard. Managed Discourse hosting updates on the hosting provider’s schedule — if you’re not self-hosted, check with your provider for rollout timing.

One check before you close the ticket

If CVE-2026-59829 applies to your deployment, pull the staff action log after patching and review review-queue activity from moderators who wouldn’t otherwise have access to the private message threads being flagged. CVSS 4.3 reflects the configuration dependency, not the potential sensitivity of the exposed content. A real deployment with active private reports against users warrants the audit.

Full CVE record: CVE-2026-55674. For CVSS scoring context on this batch, see How CVSS Scoring Works. Current exploited CVEs across all platforms: 0dayNews KEV Tracker.