CVE-2026-33411: Discourse's solved topic stream has potential stored XSS in topic title
Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a potential stored XSS in topic titles for the solved posts stream. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33411?
CVE-2026-33411 is classified as a potential stored XSS vulnerability that could impact the security of affected Discourse installations.
How do I fix CVE-2026-33411?
To mitigate CVE-2026-33411, upgrade to Discourse versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2.
What versions are affected by CVE-2026-33411?
Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 are affected by CVE-2026-33411.
What are the potential impacts of CVE-2026-33411?
The potential impact of CVE-2026-33411 includes the risk of stored cross-site scripting attacks that could compromise user data.
Is CVE-2026-33411 a remote vulnerability?
CVE-2026-33411 can be exploited remotely if an attacker can craft malicious topic titles in the Discourse platform.