Skip to content
feed: live
>_0dayNews
← All vendors
Vendor

Discourse

Security coverage of Discourse, the open-source discussion platform — vulnerability advisories, patch releases, and CVE tracking for one of the most widely deployed community forum platforms on the internet.

1 CVEs1 articlesRSS
CVEs
CVE-2026-55674
[ CRITICAL ]CVSS 9.3patched

Discourse Unauthenticated HTML Injection Enabling CSP Bypass

In Discourse before 2026.7.0, a crafted cookie injects arbitrary HTML and bypasses nonce-based CSP, enabling unauthenticated XSS. CVSS 9.3 critical.

Discourse / Discourse (prior to 2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0)
Articles
~/articles/2026-08-17-discourse-cve-2026-55674-csp-bypass
Discourse: Critical CSP Bypass Fixed, Three More CVEs
discourse

Discourse: Critical CSP Bypass Fixed, Three More CVEs

Discourse patched CVSS 9.3 HTML injection bypassing nonce-CSP plus three info-disclosure flaws. Update: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.

read →