CVE-2026-27154

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the following settings are set: `display_name_on_posts` => true; and `prioritize_username_in_ux` => false. Editing a post of a malicious user would trigger an XSS. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Score
CVSS 3.1 6.1 Medium
Status
Analyzed - security-advisories@github.com
Published
2026-02-26
Last modified
2026-03-02
Weaknesses
CWE-79

Affected products

References

 
 
© AVABIS GmbH privacypolicy about