CVE-2026-72731 discourse CVE debrief

Who should care

Discourse administrators and users with access to Data Explorer should assess exposure and prioritize patching or mitigation. This includes reviewing affected versions, restricting access to Data Explorer, and monitoring for suspicious SQL queries. The vulnerability could lead to potential unauthorized data access, emphasizing the need for prompt action to secure affected systems.

Why it matters

CVE-2026-72731 allows unauthorized SQL execution in Discourse Data Explorer, enabling any table to be read. Defenders should prioritize patching, restrict access, and monitor for suspicious queries.

• Potential unauthorized data access through Data Explorer
• Requires verification of affected versions and exposure
• Patching priority for environments with exposed Data Explorer
• Monitoring for suspicious SQL queries recommended

Technical summary

The Discourse Data Explorer plugin allows unauthorized SQL execution through crafted parameter values. Affected versions include 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1. The vulnerability has a CVSS score of 7.1. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Data Explorer is exposed to non-staff users.

Recommended defensive actions

• Patch Discourse to versions 2026.1.7, 2026.6.2, 2026.7.1, or 2026.8.0-latest.1
• Restrict access to Data Explorer to authorized users only
• Monitor for suspicious SQL queries
• Verify affected versions and exposure in managed environments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including affected versions and a CVSS score of 7.1. GitHub commits and security advisories offer additional context. The vulnerability allows unauthorized SQL execution through crafted parameter values in the Data Explorer plugin. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be be

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.