CVE-2026-55674

Discourse: Cache poisoning/XSS via color scheme cookies

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse's nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors' browsers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

We have discovered 2,640 live websites that are affected by CVE-2026-55674.

Run a Free Instant Scan



Affected Software

Product  Discourse
Category Message Boards
Vulnerable Domains2,640 live websites (62% of Discourse install base)
Vulnerable Versions
  • from 0 through 2026.1.6
  • from 2026.5 through 2026.5.2
  • from 2026.6 through 2026.6.1
Vulnerable Versions Count62 versions ( 86% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 17, 2026
  • Updated - Aug 18, 2026

Website Distribution by Country

Number of websites using CVE-2026-55674
United States1,502 websites


Germany438 websites
France127 websites
Singapore70 websites
GB53 websites
China43 websites
Netherlands40 websites
Russia35 websites
Switzerland33 websites
Brazil22 websites

Website Distribution by TLD

Number of websites using CVE-2026-55674
.com1,101 websites
.org446 websites
.net151 websites
.io119 websites
.de88 websites
.fr35 websites
.ru28 websites
.nl21 websites
.ch20 websites
.co19 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-55674

Top websites that are affected by CVE-2026-55674. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.org United States**,***
********.com United States**,***
*********.******.com GB**,***
******.********.com United States**,***
*********.******.com United States**,***
******.******.com United States**,***
*****.*************.com Germany***,***
******.********.org Germany***,***
******.*****.net United States***,***
*********.****.sh United States***,***
See full domain list

FAQ

CVE-2026-55674 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Discourse
A total of 2,640 websites have been identified as vulnerable to CVE-2026-55674, based on global website indexing conducted by WebTechSurvey.
The Discourse is affected by the CVE-2026-55674 vulnerability.
Discourse versions up to 2026.6.1 are vulnerable to CVE-2026-55674.
CVE-2026-55674 is resolved in version 2026.6.1 of Discourse.