CVE-2026-32273

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, updating a category description via API is not sanitizing the description string, which can lead to XSS attacks. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/discourse/discourse/commit/05e3da2a670cfd499649128b6c955b552451240b	Patch
https://github.com/discourse/discourse/security/advisories/GHSA-h2h4-767x-6pc8	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:discourse:discourse:::::latest:::*
	cpe:2.3:a:discourse:discourse:::::latest:::*
	cpe:2.3:a:discourse:discourse:2026.3.0::::latest:::
	cpe:2.3:a:discourse:discourse:2026.3.0::::latest.1:::

History

No history.

Information

Published : 2026-03-31 18:16

Updated : 2026-07-24 20:10

NVD link : CVE-2026-32273

Mitre link : CVE-2026-32273

CVE.ORG link : CVE-2026-32273

JSON object : View

Products Affected

discourse

discourse

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-32273", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32273", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T18:50:13.734036Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "discourse", "product": "discourse", "versions": [{"status": "affected", "version": ">= 2026.1.0-latest, < 2026.1.3"}, {"status": "affected", "version": ">= 2026.2.0-latest, < 2026.2.2"}, {"status": "affected", "version": ">= 2026.3.0-latest, < 2026.3.0"}]}]}], "published": "2026-03-31T18:16:49.897", "references": [{"url": "https://github.com/discourse/discourse/commit/05e3da2a670cfd499649128b6c955b552451240b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/discourse/discourse/security/advisories/GHSA-h2h4-767x-6pc8", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, updating a category description via API is not sanitizing the description string, which can lead to XSS attacks. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0."}, {"lang": "es", "value": "Discourse es una plataforma de discusi\u00f3n de c\u00f3digo abierto. Desde las versiones 2026.1.0-latest hasta antes de la 2026.1.3, 2026.2.0-latest hasta antes de la 2026.2.2, y 2026.3.0-latest hasta antes de la 2026.3.0, la actualizaci\u00f3n de una descripci\u00f3n de categor\u00eda a trav\u00e9s de la API no sanea la cadena de descripci\u00f3n, lo que puede llevar a ataques XSS. Este problema ha sido parcheado en las versiones 2026.1.3, 2026.2.2 y 2026.3.0."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:latest:*:*:*", "vulnerable": true, "matchCriteriaId": "F64DA8FA-BC32-4EB9-B508-6425684D3245", "versionEndExcluding": "2026.1.3", "versionStartIncluding": "2026.1.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:latest:*:*:*", "vulnerable": true, "matchCriteriaId": "26546710-17B3-4C72-930F-3BE0AD969127", "versionEndExcluding": "2026.2.2", "versionStartIncluding": "2026.2.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest:*:*:*", "vulnerable": true, "matchCriteriaId": "E3FE9277-4F6B-4FD0-991F-F0FB8D226E1C"}, {"criteria": "cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest.1:*:*:*", "vulnerable": true, "matchCriteriaId": "DFA536C2-E9D9-4A03-89C2-C344DE682EA1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}