CVE-2026-59830: Discourse: Stored XSS via unescaped actor name in post actions
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.7.0
Event History
Frequently Asked Questions
Who can exploit this issue and who is exposed?
An attacker needs an account or other ability to set a crafted display name. Users who view affected activity streams containing post action descriptions associated with that name may have attacker-controlled script execute in their browsers.
Are default Discourse deployments affected?
The provided information does not identify any configuration prerequisite. The issue affects Discourse versions prior to 2026.7.0 when user-controlled display names are rendered in the affected post action component.
How can I determine whether my instance is vulnerable?
Check the deployed Discourse version. Instances running a version earlier than 2026.7.0 are affected; version 2026.7.0 contains the fix.
What should be done if immediate upgrading is not possible?
The provided information identifies crafted display names as the attacker-controlled input and affected user activity streams as the execution path. Restricting or reviewing display-name changes and limiting access to affected activity streams can reduce exposure until the instance can be upgraded to 2026.7.0.