Discourse Vulnerabilities Let Attackers Hijack Pages for Every Visitor and Read Server Files

SL Cyber disclosed two serious Discourse vulnerabilities — CVE-2026-55674 (cache poisoning that can inject JavaScript into pages viewed by anonymous visitors, CVSS 9.3) and CVE-2026-55420 (low-privilege arbitrary file read, CVSS 7.5, possible path to RCE) — affecting self-hosted forums and potentially large numbers of users; Discourse published fixes (hosted sites patched June 15, 2026) and administrators are advised to apply updates, restrict uploads, and rotate secrets if exposure is suspected.