Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Discourse admin can run code via crafted 2FA name

CVE-2026-53963 · published 3 months ago
Summary

The Discourse discussion platform allowed a specially crafted two‑factor authentication name to appear unfiltered in a delete confirmation window. An attacker who could impersonate that account could cause an administrator’s browser to execute unwanted code. Upgrade to the latest Discourse release to resolve the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
discourse discourse >= 2026.1.0-latest, < 2026.1.5
>= 2026.1.0, < 2026.1.5
>= 2026.4.0, < 2026.4.2
>= 2026.5.0, < 2026.5.1
2026.6.0
Original advisory text
Discourse: Stored-XSS in 2FA delete confirmation modal
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published9 Jul 2026
Updated4 Nov 2026
First seen9 Jul 2026
Sources
CVE-2026-53963 · NVD
CVE-2026-53963 · MITRE
CVE-2026-53963 · OSV
GHSA-wg5x-7f23-m3r5 · GHSA
Track software like this
Free during beta