CVE-2026-55424: Discourse Topic Featured Link XSS Vulnerability (Medium)

Technical summary

CVE-2026-55424 is a stored XSS vulnerability in Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. The vulnerability exists because topic featured links are not adequately normalized and HTML-escaped before rendering in the topic list view. An authenticated user with permission to set featured links can inject malicious JavaScript that persists in the database. The attack succeeds when Discourse's default Content Security Policy (CSP) is weakened or removed—a configuration that some administrators adopt to support legacy functionality or third-party integrations. The vulnerability is confined to scenarios where both conditions are met: the attacker has featured-link privileges and CSP protections are non-standard.

Business impact

A successful exploit allows an attacker to steal session cookies, redirect users to phishing sites, deface the forum interface, or capture user input on the topic list page. The impact is amplified in communities where forum reputation or trust is critical to business operations. However, exploitation requires two preconditions: the attacker must be a user with topic-moderation privileges, and the site must have intentionally relaxed its CSP. Organizations running Discourse with default security settings are not at risk from this particular vector.

Affected systems

Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 are vulnerable. The vulnerability affects all Discourse installations, but only poses a real risk where the default CSP has been modified or disabled. Self-hosted Discourse instances and Discourse-powered forums are equally affected. Hosted Discourse instances managed by Discourse themselves should already run patched versions if their infrastructure is current.

Exploitability

Exploitability is moderate. The attacker requires valid forum credentials and permission to set featured links—typically granted to moderators or topic authors, depending on configuration. No public exploit code is available (KEV status: not listed). The attack requires user interaction: a victim must visit the topic list page where the malicious featured link is displayed. Most importantly, default Discourse installations with standard CSP settings are protected; only sites that have deliberately weakened CSP are at risk. This reduces real-world attack surface significantly.

Remediation

Upgrade to patched versions: 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5, depending on your current release branch. If immediate patching is not possible, review and restore Discourse's default Content Security Policy settings if they have been modified. Additionally, audit user roles and featured-link permissions to ensure only trusted moderators retain the ability to set topic featured links.

Patch guidance

Verify your current Discourse version and apply the appropriate patch from the versions listed above. Most administrators should upgrade to the latest stable version (2026.6.0 or later) unless they are on a long-term support track. Test patches in a staging environment first, as featured-link rendering may have subtle CSS or layout changes. Verify that your CSP configuration is restored to defaults after patching.

Detection guidance

Monitor Discourse audit logs for unusual activity by users with featured-link permissions, especially changes to topic featured links containing JavaScript patterns or encoded payloads. Check web application firewall (WAF) logs for requests containing script tags or event handlers in featured-link parameters. Review Discourse's CSP reporting if configured; a non-standard CSP that permits inline scripts will produce fewer CSP violation reports. Endpoint detection and response (EDR) tools should flag unexpected JavaScript execution originating from Discourse topic list pages.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. The CVSS score of 5.4 (Medium) reflects the requirement for authentication and user interaction, plus the dependency on non-default CSP configuration. Organizations with default Discourse settings should prioritize other Medium-risk issues. However, sites that have intentionally modified CSP should patch within 30 days, as insider threats or compromised moderator accounts could easily exploit this. The fact that it is not yet listed in CISA's KEV catalog suggests limited active exploitation in the wild.

Risk score, explained

The CVSS v3.1 score of 5.4 reflects: (1) network-based attack vector (AV:N); (2) low attack complexity (AC:L), as no special conditions are needed once prerequisites are met; (3) low privilege requirement (PR:L), since any authenticated user with topic-link permissions qualifies; (4) required user interaction (UI:R), because victims must visit the topic list; (5) changed scope (S:C), allowing the attack to affect resources beyond the vulnerable component; and (6) low confidentiality and integrity impact (C:L/I:L), as the attack can steal data or modify presentation but cannot cause system unavailability. Availability is unaffected (A:N).

Frequently asked questions