What is CVE-2026-72725?
CVE-2026-72725 affects the open-source Discourse discussion platform, where the staff action log prior to version 2026.1.6 improperly rendered previous and new value fields, leading to stored cross-site scripting vulnerability in the staff interface. The issue is fixed in the latest updates, requiring immediate upgrade.
Azərbaycanca: CVE-2026-72725: Açıq mənbəli Discourse müzakirə platformasında aşkar edilib. 2026.1.6 versiyasından əvvəl, personal fəaliyyət jurnalında (staff action log) əvvəlki və yeni dəyər sahələrinin filtrdən keçirilməməsi səbəbindən stored XSS zəifliyi mövcuddur. Məsələ ən güncəl versiyalarda düzəldilib, dərhal yeniləmə tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
In which component of the Discourse platform was CVE-2026-72725 discovered?
This vulnerability was discovered in the previous and new value fields within the staff action log.
Which version should be upgraded to in order to eliminate the CVE-2026-72725 vulnerability?
Since versions prior to 2026.1.6 are affected, it is recommended to immediately upgrade to the latest updates.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.