CVE-2026-72731

Published: Ago 10, 2026 Last Modified: Ago 10, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: low
Availability: none

Description

AI Translation Available

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability Authentication Access Control
Potential Impacts:
Execute Unauthorized Code Or Commands Read Application Data Gain Privileges Or Assume Identity Bypass Protection Mechanism Modify Application Data
Applicable Platforms
Languages: Not Language-Specific, SQL
Technologies: Database Server
Likelihood of Exploit: High
View CWE Details
https://github.com/discourse/discourse/commit/2bdab888cef56…
https://github.com/discourse/discourse/commit/2bdab888cef561348470dee204a4879d8…
https://github.com/discourse/discourse/commit/3dc7f0da7aa18…
https://github.com/discourse/discourse/commit/3dc7f0da7aa18548281152e285244efb1…
https://github.com/discourse/discourse/commit/674ba6fc64184…
https://github.com/discourse/discourse/commit/674ba6fc64184fd7d8e21183c5d8cb223…
https://github.com/discourse/discourse/commit/ce9ccf24ec353…
https://github.com/discourse/discourse/commit/ce9ccf24ec3538172dc8f8199728e08f6…
https://github.com/discourse/discourse/security/advisories/…
https://github.com/discourse/discourse/security/advisories/GHSA-wm63-83xp-59r5