Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Discourse installation to one of the fixed versions: 2026.3.0-latest.1, 2026.2.1, or 2026.1.2.

These versions include a fix that requires exact match or proper subdomain match (preceded by a dot) for the allowed_spam_host_domains check, preventing suffix-based bypass of the newuser_spam_host_threshold.

No known workarounds are available, so upgrading is the immediate and recommended step.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects the Discourse open-source discussion platform. Before certain fixed versions, the platform's spam protection check called `allowed_spam_host_domains` used a method that checked if a domain ended with an allowlisted domain without properly validating domain boundaries. This meant that malicious domains like `attacker-example.com` could bypass spam protection if `example.com` was on the allowlist, because the check only looked for a suffix match rather than an exact or proper subdomain match.

The issue was fixed in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 by requiring an exact match or a proper subdomain match (preceded by a dot) to prevent attackers from bypassing the spam host threshold protections.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to bypass spam protection mechanisms on Discourse platforms that have not been updated to the fixed versions. By exploiting the improper domain boundary validation, attackers can use malicious domains that appear similar to allowlisted domains to evade spam filters.

As a result, your platform could receive increased spam or malicious content from domains that should have been blocked, potentially degrading user experience and increasing moderation workload.

Useful 0 Not Useful 0