CVE-2026-53963: Discourse: Stored-XSS in 2FA delete confirmation modal
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.6.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.4.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.1.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53963?
CVE-2026-53963 has a severity score of 7.3, indicating a high risk due to the potential for stored cross-site scripting.
How can I fix CVE-2026-53963?
To remediate CVE-2026-53963, upgrade Discourse to version 2026.6.0 or later.
What is CVE-2026-53963 about?
CVE-2026-53963 involves stored cross-site scripting in the delete confirmation modal of Discourse due to improper escaping of a malicious second factor name.
Who is affected by CVE-2026-53963?
Administrators of Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 are vulnerable to CVE-2026-53963.
What are the potential impacts of CVE-2026-53963?
CVE-2026-53963 can lead to unauthorized script execution in the context of an administrator's session, potentially compromising sensitive information.