CVE-2026-55674

Executive Summary

CVE-2026-55674 is a critical, unauthenticated HTML injection / cross-site scripting (CWE-79) vulnerability in Discourse, an open-source discussion platform. Prior to fixed releases 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an attacker can send a single request containing a crafted color_scheme_id or dark_scheme_id cookie and inject arbitrary HTML into a Discourse page. Because the injected tag bypasses Discourse's nonce-based Content Security Policy, arbitrary JavaScript can execute in visitors' browsers, leading to session hijacking, data theft, and page content manipulation. The NVD CVSS score is 9.3 (Critical) under vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.

Technical Analysis

The vulnerability resides in how Discourse renders user-supplied cookie values into the HTML of a discussion page. The application reads two cookie values, color_scheme_id and dark_scheme_id, and places them into a color scheme tag. According to the NVD description, this cookie value is rendered into the tag without escaping. This allows an attacker-controlled value to break out of the intended attribute context using HTML metacharacters such as quotes, angle brackets, or encoded equivalents. Once out of the attribute, the attacker can inject a new HTML element.

This is a server-side output encoding failure, best classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). What makes the vulnerability particularly severe is that the injected markup is able to bypass Discourse's nonce-based Content Security Policy. Discourse's CSP is designed to prevent arbitrary script execution by requiring inline script tags to carry a valid per-request nonce. The NVD description does not provide the exact technique that allowed the injected tag to bypass this policy; the bypass could involve a malformed tag, reuse of an existing nonce context, or injection of markup that is not constrained by the CSP directive. Insufficient technical detail is available to reconstruct the exact CSP bypass mechanism, but the described outcome is arbitrary JavaScript execution in the browsers of visitors.

The attack surface is any publicly accessible Discourse instance running an affected version. The request does not require authentication, and the attacker needs no special privileges on the server. The vulnerability is triggered during normal page rendering when a request carrying a crafted cookie causes the server to generate a page containing the malicious HTML. Since Discourse serves these pages to site visitors, any user browsing an affected Discourse instance is a potential victim.

The affected versions are defined by the fixed releases: 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The existence of four fixed versions across these release lines suggests that multiple supported branches are affected. However, the provided data includes no OSV package entries and no explicit vendor patch advisory from tracked patch sources, so operational teams should confirm the fix by checking the installed Discourse version directly.

No public PoC or exploit code has been confirmed by the supplied intelligence data. The absence of an EPSS score from FIRST.org and the CISA KEV flag of NO indicate that, as of the time of analysis, there is no confirmed exploitation-in-the-wild evidence or public exploit template. This does not rule out private exploit development, and the vulnerability is technically straightforward in nature because it only relies on injecting characters that are normally found in URL-encoded cookies.

Exploitation Scenarios

The NVD description provides enough information to outline the attack chain at the vulnerability-class level, but it does not specify every delivery step. The following scenario is derived strictly from the supplied description and the underlying XSS mechanism.

1. Reconnaissance and target identification
   An attacker identifies Discourse instances by fingerprinting the application through HTML, HTTP headers, or search-engine indexes. Public discussion forums are abundant and often run unpatched versions for extended periods. The attacker can detect potential targets using web-search and network-mapping techniques, but the exact version detection depends on version disclosure features that are not described in the NVD data.

2. Triggering the vulnerability
   The attacker constructs a single HTTP request to the target Discourse instance. The request includes a color_scheme_id or dark_scheme_id cookie whose value is not a legitimate color scheme identifier but instead contains HTML injection syntax. Because the request does not require authentication, no prior account compromise is necessary. The server reads the cookie and renders its value into the color scheme tag without escaping, causing the injected HTML to become part of the served page.

3. Payload and execution method
   At the vulnerability-class level, the payload breaks out of the HTML attribute in the color scheme tag and introduces a new tag containing JavaScript. For example, a value containing a quote, followed by a > character, could terminate the attribute and element and then inject a <script>-style tag or an event-handler-based tag. According to the NVD description, the injected tag bypasses Discourse's nonce-based CSP, so the JavaScript executes in the victim's browser without being blocked by CSP. The exact payload markup is not provided in the available data; the critical requirement is that the cookie value contains HTML metacharacters that survive server-side rendering.

4. Post-exploitation impact
   Once arbitrary JavaScript executes in a visitor's browser, the attacker operates with the victim's trust level on the Discourse origin. The attacker can steal session cookies, perform authenticated actions on behalf of the victim, read private messages, alter profile settings, post malicious content, and hijack administrative sessions if the administrator browser can be induced to visit the page. The injected script can also be used to redirect users to phishing pages, download malware, or facilitate credential harvesting. Because the injected HTML appears on a trusted community site, victims are more likely to interact with it. The CVSS scope change (S:C) reflects that the impact extends beyond the vulnerable web application and directly affects the victim's browser and related resources.

Impact Assessment

The NVD CVSS score is 9.3 out of 10, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. Breaking this down at a high level:

• Attack Vector (AV:N): The vulnerability is remotely exploitable over the network.
• Attack Complexity (AC:L): No unusual conditions are required; the attack is essentially dependent on sending a crafted cookie in a request.
• Privileges Required (PR:N): No authentication or account privileges are needed to craft the malicious request.
• User Interaction (UI:R): A victim must visit or load a Discourse page that renders the crafted cookie value.
• Scope (S:C): The injected JavaScript runs in the victim's browser, impacting a security scope beyond the web application itself.
• Confidentiality and Integrity (C:H/I:H): The attacker can read sensitive data in the page/session context and modify page content or perform actions as the victim.
• Availability (A:N): The described vulnerability does not directly target availability.

The business impact is significant for communities and organizations that rely on Discourse for customer support, product discussions, or internal collaboration. A successful attack can degrade user trust, allow account takeover, facilitate social engineering, and turn a trusted discussion platform into a malware delivery point. The broad victim population is all unauthenticated visitors of affected Discourse sites, meaning the exposed population can be large for popular forums. The absence of a public PoC and the lack of a CISA KEV entry reduce immediate evidence of mass exploitation, but the vulnerability's high severity and low technical barrier mean that patching should be prioritized once a verified patch is available.

Detection Guidance

The following detection guidance focuses on unusual color_scheme_id and dark_scheme_id cookie values, because legitimate cookies should contain simple scheme identifiers rather than HTML markup. These rules are generic and should be tuned to local logging platforms and traffic characteristics. No public exploit-specific signature is available from the supplied data.

Sigma Rule

title: Potential Discourse Color Scheme Cookie HTML Injection (CVE-2026-55674)
id: d5a543a3-9f1c-4b8a-9b62-4f6d776e33d5
status: experimental
description: Detects HTTP requests to Discourse with color_scheme_id or dark_scheme_id cookie values containing HTML/JavaScript metacharacters.
logsource:
  category: webserver
  product: generic
detection:
  selection_cookie:
    http.request.cookie|contains|all:
      - 'color_scheme_id='
      - '<script'
  selection_cookie_alt:
    http.request.cookie|contains|all:
      - 'dark_scheme_id='
      - 'onerror='
  selection_encoded:
    http.request.cookie|contains|all:
      - 'color_scheme_id='
      - '%3Cscript'
  condition: selection_cookie or selection_cookie_alt or selection_encoded
level: high
falsepositives:
  - Malformed but non-malicious cookies from misbehaving client-side scripts
  - Presence of template strings in test traffic
tags:
  - attack.t1189
  - cwe-79
  - cve-2026-55674

YARA Rule

rule Discourse_ColorScheme_XSS_Cookie_Injection {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects suspicious Discourse color_scheme_id or dark_scheme_id cookie values associated with CVE-2026-55674"
        cve = "2026-55674"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55674"
    strings:
        $cookie1 = /color_scheme_id=[^;]*[<>"']/i
        $cookie2 = /dark_scheme_id=[^;]*[<>"']/i
        $tag = /<script[^>]*>/i
        $handler = /on(load|error|click|mouseover)\s*=/i
        $encoded = /%3C(s|i)cript/i
    condition:
        any of ($cookie*) and any of ($tag, $handler, $encoded)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Potential Discourse color_scheme_id Cookie HTML Injection (CVE-2026-55674)";
 flow:established,to_server;
 http.cookie;
 content:"color_scheme_id="; nocase;
 pcre:"/color_scheme_id=[^\;]*(?:<|>|\x3C|\x3E|%3C|%3E|on[a-z]+\s*=)/i";
 sid:202655674; rev:1;
 metadata: cve CVE-2026-55674, cwe CWE-79, mitre-tactic T1189, target web_server;)

Elastic Detection

any where event.category == "web" and
  (stringContains(http.request.cookie, "color_scheme_id=") or
   stringContains(http.request.cookie, "dark_scheme_id=")) and
  (stringContains(http.request.cookie, "<script") or
   stringContains(http.request.cookie, "onerror=") or
   stringContains(http.request.cookie, "onload=") or
   stringContains(http.request.cookie, "%3Cscript"))

Splunk SPL Query

index=web* earliest=-7d latest=now()
| rex field=cookie max_match=0 "(?i)(?:color_scheme_id|dark_scheme_id)=(?<scheme_val>[^;&]+)"
| where match(scheme_val, "(?i)(<|%3C|%3E|>|onload=|onerror=|javascript:|\x3c|\x3e)")
| table _time src_ip dest_ip uri http_user_agent cookie scheme_val
| sort _time desc

Wazuh OSSEC Rule

<group name="web_application,xss,">
  <rule id="100255" level="12">
    <decoded_as>web</decoded_as>
    <match>color_scheme_id=|dark_scheme_id=</match>
    <regex>color_scheme_id=[^;]*(<|%3C|&lt;)</regex>
    <regex>dark_scheme_id=[^;]*(<|%3C|&lt;)</regex>
    <description>Discourse color scheme cookie contains HTML injection indicators (CVE-2026-55674)</description>
    <mitre>
      <id>T1189</id>
      <tactic>Initial Access</tactic>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

The provided intelligence lists Patch Confidence as 0/4, meaning no patch evidence was confirmed by any tracked patch source, even though the NVD description names specific fixed versions. Administrators should treat the NVD-mentioned versions as the likely vendor fix but must verify them against an official Discourse release advisory before relying on them.

Immediate mitigations:

• Deploy a WAF or reverse-proxy rule that validates color_scheme_id and dark_scheme_id cookie values. Reject requests where these cookies contain characters other than digits, letters, underscores, or hyphens, if such values are not expected in the deployment.
• Add HTTP response and request inspection to block obvious HTML metacharacters such as <, >, %3C, %3E, and < when present in these specific cookie values.
• Monitor web server logs for multiple requests containing suspicious cookie values to identify reconnaissance and attempted exploitation.

Patch / upgrade steps:

• Upgrade Discourse to one of the fixed versions as applicable to your release branch: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0. Confirm with the Discourse project that the used upgrade path is supported.
• After upgrading, verify the version string in the administrative interface and run a browser-side validation test using a non-malicious payload that contains a harmless marker such as CVE202655674TEST to confirm it is HTML-encoded in the response.
• Because multiple release branches are named in the NVD description, ensure every deployed Discourse instance is upgraded, not just a single main production instance.

Long-term hardening:

• Ensure all server-side rendering of cookie-derived values uses context-aware HTML encoding. The fix for this class of bug should include escaping quotes, angle brackets, and ampersands in every attribute context.
• Review the Discourse CSP implementation to ensure nonce-based CSP cannot be bypassed by injected tags in server-rendered markup. If possible, add a strict script-src directive without 'unsafe-inline'.
• Set hardening HTTP headers, including X-Content-Type-Options: nosniff and a strong, nonce-requiring CSP, as defense-in-depth even after patch deployment.
• Subscribe to Discourse security release notifications and monitor CISA KEV and FIRST.org EPSS channels for future updates.

References

• NVD entry for CVE-2026-55674: https://nvd.nist.gov/vuln/detail/CVE-2026-55674
• MITRE CWE-79 Cross-Site Scripting: https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK Technique T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-55674 not listed as exploited): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Discourse Project (official open-source repository): https://github.com/discourse/discourse

No known threat-actor campaigns or exploit-in-the-wild evidence were reported in the supplied data. The CISA KEV flag is NO, and FIRST.org has not yet produced an EPSS score for CVE-2026-55674.