Discourse Vulnerabilities Let Attackers Hijack Pages for Every Visitor and Read Server Files
Do Son 
Final full chain script execution | Image: Slcyber
TL;DR
SL Cyber found two Discourse vulnerabilities in a forum platform that powers more than 22,000 communities. One lets an unauthenticated attacker push malicious JavaScript to every anonymous visitor. The other lets a brand-new forum member read files from the server.
- Product: discourse
- Vulnerabilities: 2 flaws (CVE-2026-55674, CVE-2026-55420)
- Highest severity: 9.3 (Critical · CVSSv3)
- Worst impact: Cache poisoning/XSS via color scheme cookies
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-55674 | 9.3 | CWE-79 | Not exploited |
| CVE-2026-55420 | 7.5 | CWE-78 | Not exploited |
The researchers detailed their findings in a write-up. Discourse has patched both issues. Its hosted customers received fixes on June 15, 2026.
Why It Matters
Discourse hosts community forums for well-known names, including OpenAI, Atlassian and Cloudflare, according to SL Cyber. As a result, a single flaw can reach a very large audience.
The first bug, CVE-2026-55674, carries a critical CVSS score of 9.3. SL Cyber says it leads to “JavaScript execution on every page for every anonymous visitor.” Worse, the team notes it is “exploitable without authentication.”
The second bug, CVE-2026-55420, scores 7.5. It requires “only a Trust Level 0 account,” the lowest level a new member receives. Moreover, the researchers warn that the flaw “should therefore be considered a potential path to complete server compromise, rather than file disclosure alone.”
What Each Flaw Lets Attackers Do
CVE-2026-55674: cache poisoning to stored XSS
This flaw lets an outsider plant malicious JavaScript in pages that Discourse serves to logged-out visitors. The attacker needs no account at all. Once planted, the script runs in the browsers of everyone who loads the affected pages.
In practice, an attacker could redirect visitors to malicious sites or show them fake login prompts. They could also change what a forum appears to say. The official advisory adds that the injected code could get past the site’s Content Security Policy, a key browser defense.
CVE-2026-55420: arbitrary file read
This flaw lets a low-privilege member read files stored on the Discourse server. Those files can include configuration data and application secrets.
SL Cyber stopped at file read during its research. However, the team believes stolen secrets could open the door to code execution. Discourse’s own advisory goes further. It describes the issue as a path to remote code execution “under certain non-default configurations.”
Who is at risk
- Self-hosted forums running unpatched Discourse releases face both flaws.
- Anonymous visitors to those forums are the targets of CVE-2026-55674.
- Forums with open sign-up face higher risk from CVE-2026-55420, since anyone can get a Trust Level 0 account.
- Hosted Discourse customers received fixes on June 15, 2026, and need no action.
Note one point of disagreement. SL Cyber says both bugs affect default configurations. By contrast, Discourse’s advisory for CVE-2026-55420 limits it to certain non-default setups. Admins should therefore patch rather than rely on their configuration.
Exploitation status
No exploitation in the wild has been confirmed. SL Cyber has published a technical write-up. Still, no standalone public exploit has been confirmed.
Affected Versions
- CVE-2026-55674: Discourse releases before 2026.1.6, 2026.5.2, 2026.6.1 and 2026.7.0.
- CVE-2026-55420: Discourse releases before 2026.1.5, 2026.4.2, 2026.5.1 and 2026.6.0.
Disclosure timeline
- June 9, 2026: SL Cyber reported both issues to Discourse.
- June 15, 2026: Discourse confirmed the bugs and fixed hosted sites.
- June 30, 2026: The CVE-2026-55420 fix went public.
- July 28, 2026: The CVE-2026-55674 fix went public.
Patch and Mitigation Steps
- Upgrade to 2026.7.0, or to 2026.6.1, 2026.5.2 or 2026.1.6 on older branches. Each of these covers both Discourse vulnerabilities.
- If you cannot update yet, disable PDF uploads or limit upload rights to trusted users.
- Review who can upload files, especially on forums with open registration.
- After patching, rotate application secrets if you suspect any exposure.
The fixes also harden the platform. According to SL Cyber, Discourse now ships “a default-deny security policy” for image processing. The team summed up the lesson plainly: “ImageMagick continues to be one of the most rewarding targets for security research.”
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
