CVE-2026-33411 MEDIUM

CVE-2026-33411: Discourse's solved topic stream has potential stored XSS in topic title

Vendor Discourse
Product discourse
Weakness CWE-79 · XSS
Published March 20, 2026
Last update March 24, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a potential stored XSS in topic titles for the solved posts stream. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.

Key dates

02Disclosure timeline

March 20, 2026 CVE published
March 24, 2026 Record updated