CVE-2026-53963 is a high severity stored cross-site scripting flaw (CVSS 7.3) in Discourse. A crafted second factor name is not escaped in a delete confirmation dialog, so it can run script when an administrator impersonates the account. It is fixed in 2026.6.0, 2026.5.1, 2026.4.2 and 2026.1.5.
What's affected
- Discourse releases before 2026.6.0, before 2026.5.1, before 2026.4.2 and before 2026.1.5, per the record.
- Fixed in 2026.6.0, 2026.5.1, 2026.4.2 and 2026.1.5. Pick the fixed release on the branch you already run.
- The trigger described by the record needs an administrator to impersonate the attacker controlled account.
How to check if you're exposed
Open the admin dashboard of your Discourse site and read the installed version. If you deploy with the standard Docker setup, compare it against the fixed releases above for your branch. If you run a version older than the fixed release on your branch, you are exposed. Then look at how your team uses impersonation. The risk is highest on forums where several admins impersonate members to reproduce problems.
What to do now
- Update Discourse to 2026.6.0, 2026.5.1, 2026.4.2 or 2026.1.5, whichever matches your branch.
- Until you update, avoid impersonating accounts you do not trust, particularly accounts with second factor entries you did not review.
- Review recent impersonation sessions in your staff action logs for anything unexpected.
- Record the new version in your asset inventory.
Why it matters
The class is CWE-79, improper neutralization of input during web page generation. User supplied text, here the name of a second factor, was placed into the page without escaping. The fix commit escapes the name in the delete confirmation dialog.
The record scores this with user interaction required and low privileges, which fits the scenario: the attacker prepares the account, and an administrator has to take the step that loads the dialog. The impact is script running in the administrator session. The record does not mark the CVE as exploited in the wild.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Does this affect users who never get impersonated?
The record ties the issue to an administrator impersonating the attacker controlled account. Still, update, because the fix is a small release on your branch.
Sources
- https://github.com/discourse/discourse/releases/tag/v2026.1.5
- https://github.com/discourse/discourse/releases/tag/v2026.4.2
- https://github.com/discourse/discourse/commit/40de62cddadc65c328a1028ab999f3fa94adbfed
Last reviewed: 19 October 2026.
