CVE-2026-72730 is a stored XSS in Discourse's chat-transcript username rendering path. The vulnerability lives in how usernames—user-controlled data—are rendered inside the Rich Text Editor when chat transcripts are displayed. Chat transcripts are auto-generated by the system, which appears to have led developers to treat this rendering surface as implicitly trusted HTML rather than applying the same escaping rigor you'd expect for user-submitted post content. That assumption failure is the root cause: internally-generated infrastructure was treated as a trust boundary, but the data flowing through it (usernames) was never validated as untrusted input.
The CVSS 8.7 reflects the real risk in a collaborative platform context. Discourse hosts technical communities and enterprise forums where moderators and administrators regularly click into chat transcripts expecting safe system output. If a payload persists in a transcript, it fires against exactly the users with elevated privileges who adjudicate disputes by reviewing quoted conversations. This isn't random post-viewer exploitation—it's targeting the trust hierarchy directly.
The four-branch synchronized fix (2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0) is unusual and telling. It suggests the vulnerable code path existed across release trains, likely as legacy infrastructure predating current security tooling. This raises a critical question: what other rendering paths in Discourse carry the same implicit-trust assumption? Chat transcripts are "forgotten architecture"—features that stop receiving active security review while still accepting user-controlled input.
For defenders: prioritize patching, but also audit other auto-generated content paths (notifications, exports, system messages) for the same pattern. The vulnerability existed because rendering pipelines crossing component boundaries—system-generated content meets rich text editor—fell between testing scopes. Your audit should look there.