CVE-2026-72731: Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer
Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discoursedataexplorer/dataexplorer.rb and plugins/discourse-data-explorer/lib/discoursedataexplorer/workflows/sqlaction/v1.rb. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
discourseto a version that resolves this vulnerability.Fixed in 2026.1.7 - Upgrade
Upgrade
discourseto a version that resolves this vulnerability.Fixed in 2026.6.2 - Upgrade
Upgrade
discourseto a version that resolves this vulnerability.Fixed in 2026.7.1 - Upgrade
Upgrade
discourseto a version that resolves this vulnerability.Fixed in 2026.8.0-latest.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72731?
The severity of CVE-2026-72731 is classified as high with a score of 7.1.
How can I mitigate CVE-2026-72731?
To mitigate CVE-2026-72731, upgrade Discourse to versions 2026.1.8 or later, where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-72731?
CVE-2026-72731 is an SQL Injection vulnerability affecting the Data Explorer feature in Discourse.
Who is affected by CVE-2026-72731?
CVE-2026-72731 affects users who are able to run parameterized queries in the Data Explorer, including non-staff members of a shared group.
What are the potential impacts of CVE-2026-72731?
The potential impacts of CVE-2026-72731 include unauthorized data access and manipulation by exploiting SQL comment stripping and parameter interpolation issues.