Threat Intelligence Report: CVE-2026-72731

Executive Summary

CVE-2026-72731 is a critical SQL injection vulnerability in the Discourse Data Explorer plugin, affecting all Discourse deployments running versions 2026.1.0 through 2026.1.6, and earlier versions preceding 2026.6.2, 2026.7.1, and 2026.8.0-latest.1. The vulnerability allows any user with access to a shared Data Explorer query — including non-staff members of a group — to escape the intended query parameters and execute arbitrary SQL statements, enabling unauthorized read access to any table in the database. With a CVSS score of 7.1 and a network-exploitable attack vector requiring only low-privilege access, this vulnerability poses a significant confidentiality risk to Discourse communities, particularly those running self-hosted or on-premises deployments.

The root cause lies in recursive parameter interpolation within the Data Explorer query engine, where crafted parameter values can introduce additional parameters and SQL comments can be abused to inject arbitrary statements. While the read-only transaction context prevents data modification, the ability to read any table represents a serious data exfiltration vector for forums hosting sensitive user data, private messages, or administrative records.

Technical Analysis

The vulnerability resides in the Discourse Data Explorer plugin, specifically in two files: plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb. The Data Explorer plugin is designed to allow users to run parameterized SQL queries against the Discourse database through a web interface, with parameters intended to be safely substituted into query templates.

Vulnerability Mechanism:

The core flaw is a recursive parameter interpolation bypass. When a user submits a Data Explorer query with parameters, the plugin processes these parameters through an interpolation routine. The vulnerability exploits two distinct weaknesses:

1. Recursive Parameter Introduction: The parameter interpolation logic processes parameter values in a single pass but fails to prevent a parameter value from containing references to other parameters. A crafted parameter value can include a string like {{another_parameter}} which the interpolation engine recursively expands, allowing an attacker to inject arbitrary SQL fragments through a chain of nested parameter references.

2. SQL Comment-Based Injection: Parameter declarations embedded in SQL comments within query templates are processed by the interpolation engine. An attacker can exploit this by crafting parameter values that, when combined with the comment-based declaration syntax, terminate the intended statement and inject a new SQL statement or modify the existing one.

The combined effect allows an attacker to craft parameter values that escape the intended query context and execute arbitrary SQL beyond what the original parameterized query was designed to allow.

Attack Surface:

• Authentication Requirement: The attacker must have an account on the Discourse instance and be a member of a group with which a Data Explorer query has been shared. This includes non-staff members, meaning the attack surface extends to any authenticated user with group access privileges.
• Network Exposure: The vulnerability is exploitable remotely over the network (AV:N) with low attack complexity (AC:L), requiring no user interaction (UI:N).
• Privilege Scope: The privilege required is low (PR:L) — a standard authenticated account with group membership suffices.
• Impact Scope: The attack remains within a single security scope (S:U), but the confidentiality impact is high (C:H) because any table in the database can be read, and integrity impact is low (I:L) due to potential partial data manipulation.

Technical Limitations:

The NVD description notes that queries run in a read-only transaction, which limits the integrity impact to low. Attackers cannot modify, insert, or delete data. However, the confidentiality impact is rated high, as the arbitrary SQL execution permits reading any table — including authentication tokens, email addresses, private messages, and other sensitive forum data.

Code-Level Considerations:

The description specifically identifies two code paths as vulnerable, but without the actual source code available for analysis, we cannot enumerate the exact vulnerable functions beyond confirming the file paths. The mechanism described — recursive parameter interpolation and SQL comment parsing — is consistent with the failure mode of a template-based SQL generation engine that does not adequately sanitize parameter inputs before final SQL assembly.

Exploitation Scenarios

Attack Chain Overview:

The attack follows a logical progression from target identification to data exfiltration, leveraging the authenticated access requirement and the SQL injection flaw.

Step 1: Reconnaissance and Target Identification

An attacker first identifies a target Discourse instance running a vulnerable version (2026.1.0 through 2026.1.6, or pre-2026.6.2/2026.7.1/2026.8.0-latest.1). Public Discourse instances typically expose version information through HTTP response headers, /about pages, or Discourse's public API endpoints. The attacker then creates an account on the target instance and obtains membership in a group that has Data Explorer queries shared with it. Groups with Data Explorer query access are common in Discourse communities that use custom reporting or moderation workflows.

Step 2: Triggering the Vulnerability

Once authenticated with the required group access, the attacker navigates to the Data Explorer interface and selects a shared query that accepts parameters. The vulnerability is triggered by crafting parameter values that exploit the recursive interpolation and comment-based injection flaws. Specifically, the attacker submits a parameter value that includes:

• Nested parameter syntax that causes the interpolation engine to process additional parameters
• SQL comment syntax that bypasses the intended query structure

The crafted parameter value escapes the intended placeholder context and becomes part of the executed SQL statement.

Step 3: Payload and Execution Method

At the vulnerability-class level, the attacker leverages a classic SQL injection technique — injecting SQL syntax through unsanitized parameters. The recursive interpolation flaw allows the attacker to chain multiple parameter expansions, ultimately injecting a complete SQL statement. Because the injection occurs at the parameter substitution layer, the attacker has control over the SQL being executed.

Example of the mechanism (illustrative, not actual code):

• The query template might be: SELECT * FROM users WHERE group_id = '{{group_param}}'
• An attacker could supply: ' UNION SELECT id, email, password_hash FROM users -- as the parameter value
• The recursive interpolation expands this into the final SQL, executing unauthorized data retrieval

The SQL comment injection vector allows the attacker to terminate the intended statement and append arbitrary clauses, bypassing any validation that might truncate or sanitize input.

Step 4: Post-Exploitation Impact

The attacker successfully executes arbitrary SQL within a read-only transaction, allowing comprehensive data exfiltration. The attacker can:

• Read all data from any table accessible within the PostgreSQL database used by Discourse
• Extract user credentials (hashed passwords, email addresses, usernames)
• Access private messages, moderation logs, and other sensitive forum content
• Enumerate the database schema to identify additional sensitive data

The read-only transaction limit prevents data modification, but the confidentiality breach is complete. The stolen data can be used for credential stuffing, targeted phishing, account takeover attempts, or sold on dark web markets.

Availability of Public Exploits:

No public PoC is available and no Nuclei templates or exploit code have been identified at the time of writing. The attack chain described above is inferred from the vulnerability class (SQL injection) and the mechanism details provided in the NVD description. Organizations should assume that skilled attackers can develop working exploits once they analyze the patched and unpatched versions of the vulnerable files.

Impact Assessment

CVSS Analysis (Score: 7.1, High):

• Attack Vector (AV:N): Network-exploitable, meaning remote exploitation is possible without physical or adjacent network access.
• Attack Complexity (AC:L): Low complexity — no special conditions or race conditions required for successful exploitation.
• Privileges Required (PR:L): Low — only a standard authenticated account with group membership is needed.
• User Interaction (UI:N): None — the attack does not require victim interaction.
• Scope (S:U): Unchanged — the impact remains within the vulnerable component's security scope.
• Confidentiality (C:H): High — arbitrary SQL execution allows reading any table in the database.
• Integrity (I:L): Low — the read-only transaction limits integrity impact to partial data manipulation.
• Availability (A:N): None — the vulnerability does not enable denial-of-service attacks.

Business Impact:

For organizations operating Discourse as their community platform, this vulnerability presents a severe risk to user privacy and platform trust. The ability to read any database table means that:

• Personally Identifiable Information (PII) of all forum users may be exposed
• Authentication data (password hashes, session tokens) may be compromised, potentially leading to account takeover across the platform
• Private communications stored in the database may be leaked, causing reputational damage and potential legal liability (GDPR, CCPA violations)
• Proprietary business data stored within Discourse (e.g., internal announcements, support tickets) may be exposed

Affected Systems:

All self-hosted Discourse instances running the Data Explorer plugin with affected versions are at risk. Discourse Cloud (official hosted offering) users are likely protected by automatic updates, but on-premises deployments that have not patched are vulnerable. The vulnerability also affects any third-party Discourse hosting providers that have not applied the fix.

Blast Radius:

The blast radius is broad — any Discourse community with shared Data Explorer queries is potentially exposed. The privilege requirement (group membership) somewhat limits the attack surface, but many public Discourse forums allow open registration, making account creation trivial. The 14.0% percentile EPSS score (0.00231) suggests low active exploitation as of the scoring date, but this is likely due to the novelty of the CVE and a lack of public PoC availability.

Detection Guidance

The following detection rules are designed to identify exploitation attempts against CVE-2026-72731. Since the vulnerability manifests as SQL injection through the Data Explorer interface, detection should focus on anomalous SQL patterns in Data Explorer requests, recursive parameter behavior, and unusual database queries originating from authenticated users.

Sigma Rule

title: Discourse Data Explorer SQL Injection Attempt (CVE-2026-72731)
id: 86a3f2c4-7d21-4e9b-8a07-b34d77e2c5f1
status: experimental
description: Detects potential SQL injection attempts via Discourse Data Explorer parameter values, targeting recursive parameter interpolation and comment-based injection vectors.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72731
author: Valtersit Threat Intelligence
date: 2026/09/15
logsource:
    product: discourse
    category: application
detection:
    selection_data_explorer:
        http.url_extension:
            - '/admin/plugins/explorer'
            - '/explorer'
        http.method: 'POST'
    selection_sql_patterns:
        http.body|contains|all:
            - '{{'
            - '}}'
        http.body|contains|any:
            - 'UNION'
            - 'SELECT'
            - 'FROM'
            - 'DROP'
            - '--'
            - '/*'
            - '*/'
    selection_parameter_abuse:
        http.body|contains|any:
            - "{{__"
            - "{{query"
            - "params"
            - "render_sql"
    condition: selection_data_explorer and selection_sql_patterns and selection_parameter_abuse
falsepositives:
    - Legitimate use of Data Explorer by admins building complex queries
    - Parameters containing the word "SELECT" as part of normal text
level: high

YARA Rule

rule Discourse_Data_Explorer_SQLi_CVE_2026_72731
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SQL injection attempts targeting Discourse Data Explorer recursive parameter interpolation and comment injection (CVE-2026-72731)"
        date = "2026-09-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72731"
        score = 70
        cve = "CVE-2026-72731"
    strings:
        $a = "data_explorer"
        $b = "discourse_data_explorer" ascii nocase
        $c = "parameter" ascii nocase
        $d = "params" ascii nocase
        $e = "UNION" ascii nocase
        $f = "SELECT" ascii nocase
        $g = "FROM" ascii nocase
        $h = "/*" 
        $i = "--" 
        $j = "{{" 
        $k = "}}" 
    condition:
        (uint16(0) == 0x8950) or  // typical file header if scanning binary
        any of ($a,$b,$c,$d) and
        any of ($e,$f,$g) and
        any of ($h,$i) and
        any of ($j,$k)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-72731 Discourse Data Explorer SQL Injection Attempt"; flow:to_server,established; content:"/explorer"; http_uri; nocase; content:"POST"; http_method; pcre:"/(UNION|SELECT|FROM|DROP|INSERT|UPDATE|DELETE|--|\/\*)/i"; pcre:"/(\{\{|##|\?\?)/"; reference:cve,2026-72731; classtype:attempted-user; sid:2026727311; rev:1;)

Rule Explanation: The Suricata rule inspects HTTP POST requests to the Data Explorer endpoint (/explorer), looking for SQL keywords combined with parameter interpolation markers ({{, ##, ??). The rule uses PCRE matching to detect the recursive parameter injection pattern and SQL syntax that would indicate an injection attempt.

Elastic Detection

any where process.name == "ruby" or process.name == "passenger" or process.name == "puma"
| filter event.code == "SQL_QUERY" or event.action == "sql_query"
| filter process.args like "*discourse_data_explorer*"
| filter query contains "union" or query contains "select" and query contains "from"
    or query contains "/*" or query contains "--"
    or query contains "{{" 
| filter user.name != null
| filter source.ip != null

Detection Notes: This EQL query looks for SQL query events generated by the Discourse application (Puma/Passenger) that reference the Data Explorer plugin and contain SQL injection indicators. The query matches on the combination of UNION/SELECT/FROM statements, comment syntax, and parameter interpolation markers associated with the vulnerability.

Splunk SPL Query

index=discourse sourcetype="discourse:audit" 
    OR sourcetype="postgresql:query" 
    (endpoint="/explorer" OR component="data_explorer")
| search (body="UNION" OR body="SELECT" OR body="FROM" OR body="DROP")
    OR (body="/*" OR body="--" OR body="{{") 
| search body="params"
| eval suspicious=if(match(body, "(?i)(UNION|SELECT|FROM|DROP)" ) AND match(body, "\{\{|##|\?\?"), "CRITICAL", 
    if(match(body, "(?i)(UNION|SELECT|FROM)"), "HIGH", "MEDIUM"))
| stats count by src_ip, user, endpoint, suspicious, _time
| sort - count
| where suspicious != "MEDIUM"
| table _time, src_ip, user, endpoint, suspicious, count

Wazuh OSSEC Rule

<group name="discourse,sql_injection,">
  <rule id="481737" level="12">
    <decoded_as>json</decoded_as>
    <field name="component">data_explorer</field>
    <regex>UNION|SELECT|FROM|DROP</regex>
    <regex>\{\{|\?\?|##|/\*|--</regex>
    <description>Discourse Data Explorer SQL Injection attempt (CVE-2026-72731)</description>
    <group>discourse,sql_injection,cve,cve-2026-72731,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source (OSV) claims patch; not independently confirmed). While the NVD description confirms the fixed versions, the vendor has not yet independently published a comprehensive advisory. Organizations should verify patch availability through official Discourse channels.

1. Immediate Mitigations (0-48 hours)

• Restrict Data Explorer Access: Immediately revoke Data Explorer query access for all non-staff groups. Review group permissions in the Discourse admin panel (Admin → Plugins → Data Explorer) and ensure only trusted administrators retain query execution privileges.
• Audit Existing Queries: Review all currently-shared Data Explorer queries for parameterized inputs. If any query templates appear vulnerable or overly broad, disable them until patched.
• Monitor Database Query Logs: Enable or increase verbosity of PostgreSQL query logging. Look for anomalous queries originating from the Data Explorer process, especially those with unusual UNION, SELECT, or comment-based constructs.
• Web Application Firewall (WAF) Rules: Deploy temporary WAF rules to block or alert on SQL injection patterns in requests to Data Explorer endpoints. Use the Suricata rule provided above as a reference for pattern matching.

2. Patch and Upgrade Steps

• Upgrade to Fixed Versions: Upgrade Discourse to version 2026.1.7, 2026.6.2, 2026.7.1, or 2026.8.0-latest.1 — whichever aligns with your current release branch.
• Update Data Explorer Plugin: Ensure the Data Explorer plugin is also updated to the version bundled with the fixed Discourse release. If using a standalone plugin installation, verify that the plugin version matches the patched release.
• Verify Patch Integrity: After upgrading, verify that the two identified files (data_explorer.rb and workflows/sql_action/v1.rb) reflect the patched versions. Check Discourse's official changelog or the OSV advisory for specific commit references.
• Test After Upgrade: After applying the patch, test Data Explorer functionality with known-benign parameterized queries to confirm the recursive interpolation and comment-based injection vectors are no longer exploitable.

3. Long-Term Hardening

• Apply Principle of Least Privilege: Follow the principle of least privilege for Data Explorer access. By default, only staff members should have query execution rights. Group sharing should be an exception, not the norm, and reviewed quarterly.
• Implement Database Least-Privilege: Configure the Discourse PostgreSQL user to have restricted permissions compatible with Discourse functionality. Consider a dedicated database role for Data Explorer that has read-only access to only necessary tables, further limiting the blast radius of any future SQL injection.
• Enable Comprehensive Audit Logging: Enable Discourse's audit log and ensure PostgreSQL logs capture all queries. Deploy a SIEM (e.g., Splunk, Elastic, Wazuh) to collect and alert on these logs using the detection rules provided in this report.
• Regular CVE Monitoring: Subscribe to Discourse security advisories (discourse.org/security) and OSV notifications to stay informed of future vulnerabilities.
• Consider RLS (Row-Level Security): Where feasible and supported, implement PostgreSQL Row-Level Security to further restrict query access for the Data Explorer role.
• Periodic Security Reviews: Conduct code-level reviews of any custom Data Explorer queries that are shared across groups, ensuring parameterization is correctly implemented and no query templates contain unsafe constructs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72731 — Official NVD vulnerability description and CVSS scoring.
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-72731 — Open Source Vulnerability database entry providing patch references and affected version details.
3. Discourse Official Security Page: https://discourse.org/security — Discourse's official security advisory hub (monitor for vendor-advisory release confirming patch confidence).
4. CVE Mitre Entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72731 — CVE record listing.
5. CISA KEV: Not listed in CISA's Known Exploited Vulnerabilities catalog at the time of writing — see https://www.cisa.gov/known-exploited-vulnerabilities-catalog for updates.

Threat Actor Campaigns and Exploitation in the Wild: As of the writing of this report, there are no confirmed reports of active exploitation of CVE-2026-72731 in the wild. The EPSS score of 0.00231 (14.0% percentile) indicates low exploit probability based on available data. However, given the low complexity of exploitation and the high value of data accessible via Discourse databases, organizations should not discount the risk of imminent exploitation once PoC code becomes publicly available.