CVE-2026-55674: Discourse Unauthenticated HTML Injection via Cookie

Overview

A critical HTML injection vulnerability has been disclosed in Discourse, the popular open-source discussion platform. Tracked as CVE-2026-55674 with a CVSS score of 9.3, this flaw allows an unauthenticated remote attacker to inject arbitrary HTML content into any Discourse page by sending a single crafted HTTP request.

The vulnerability stems from improper sanitization of the color_scheme_id (and dark_scheme_id) cookie values, which were rendered directly into page output without adequate escaping.

Technical Details

Prior to the patched versions (2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0), Discourse accepted cookie values for color scheme preferences and rendered them inline without proper sanitization. An attacker could set a malicious color_scheme_id cookie containing arbitrary HTML — including <script> tags or phishing content — which would then be rendered on any page the victim visits.

Because no authentication is required, the attack surface is extremely broad. Any public or semi-public Discourse instance is vulnerable to:

• Cross-site scripting (XSS) via injected script tags
• Phishing overlays rendered on top of legitimate content
• Session hijacking if combined with social engineering
• Data exfiltration from the browser context

The vulnerability requires only a single HTTP request with a crafted cookie, making it trivial to exploit at scale.

Affected Versions

Remediation

Discourse instance administrators should immediately upgrade to one of the patched versions. No workaround is available that does not involve upgrading.

1. Update your Discourse installation to the latest stable release
2. Review access logs for any unusual color_scheme_id cookie values
3. Check for injected content in cached pages or CDN caches

If you are using a managed Discourse hosting service, verify with your provider that the patch has been applied.

Severity Assessment

References

• NVD — CVE-2026-55674
• Discourse Security Advisories