CVE-2026-32273: Discourse: XSS on category description update via API
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, updating a category description via API is not sanitizing the description string, which can lead to XSS attacks. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.2.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32273?
CVE-2026-32273 is classified as a medium severity vulnerability due to its potential for XSS attacks.
How do I fix CVE-2026-32273?
To address CVE-2026-32273, upgrade Discourse to version 2026.1.3, 2026.2.2, or later.
Who is affected by CVE-2026-32273?
CVE-2026-32273 affects Discourse versions from 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0-latest.
What type of vulnerability is CVE-2026-32273?
CVE-2026-32273 is an XSS vulnerability related to the unsanitized update of category descriptions via the API.
Can CVE-2026-32273 lead to data compromise?
Yes, CVE-2026-32273 can lead to data compromise by allowing attackers to execute malicious scripts in the context of a user’s session.