Paper/Archive/CVE-2026-53963

CVE-2026-53963

discourse discourse — Discourse: Stored-XSS in 2FA delete confirmation modal

CVSS 9.0 (NVD)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 54.5.545 × 2010.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Affected

ProductAffectedFixed inSource

discourse>= 2026.1.0-latest, < 2026.1.5–CNA

discourse>= 2026.4.0-latest, < 2026.4.2–CNA

discourse>= 2026.5.0-latest, < 2026.5.1–CNA

Scores by source

NVD9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

GitHub_M (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References