CVE-2026-91159

Deferred Deferred - Pending Action

Stored XSS in Discourse via oEmbed iframe allowlist

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-91159

EUVD

EUVD-2026-101299

Affected Vendors & Products

Vendor	Product	Version / Range
discourse	discourse	< 2026.1.9
discourse	discourse	>= 2026.7.0-latest, < 2026.7.3
discourse	discourse	>= 2026.8.0-latest, < 2026.8.1
discourse	discourse	>= 2026.9.0-latest, < 2026.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability in Discourse allowed attackers with posting permissions to inject malicious HTML and CSS into forum posts by exploiting oEmbed processing. If an attacker controlled a public webpage and its oEmbed response, they could include an allowlisted iframe (like YouTube) along with unrelated HTML or CSS. The system treated the entire fragment as trusted if the iframe matched the allowlist, enabling stored visual overlays or misleading UI elements that could trick users into fraudulent interactions.

Detection Guidance

To detect this vulnerability, check if your Discourse instance is running a vulnerable version (2026.1.0 to 2026.8.0, 2026.7.0-2026.7.2). Review oEmbed processing logs for suspicious HTML fragments containing iframes with allowlisted sources but additional malicious sibling elements like styles or divs. Inspect posts for unexpected visual overlays or styled content.

Impact Analysis

An attacker could create posts that appear legitimate but contain hidden or misleading elements, such as fake login forms or deceptive buttons. Users might unknowingly interact with these fraudulent UI elements, leading to phishing attacks or credential theft. The impact is limited to content integrity, as no restricted data is exposed or service disrupted.

Compliance Impact

This vulnerability primarily impacts content integrity by allowing misleading visual overlays or fraudulent UI elements in posts. It does not expose restricted data or disrupt service, so direct violations of GDPR or HIPAA are unlikely unless misleading content leads to unauthorized data disclosure or privacy violations.

Mitigation Strategies

Update Discourse to versions 2026.9.0, 2026.8.1, 2026.7.3, or 2026.1.9 or later to apply the security patch.

Review and restrict the iframe allowlist in Discourse settings to minimize exposure by removing less-essential providers.

Hi! I’m here to help you understand CVE-2026-91159. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70