CVE-2026-91132

Deferred Deferred - Pending Action

Stored XSS in Discourse via Crafted iframe URL

Publication date: 2026-09-24

Last updated on: 2026-09-29

Assigner: GitHub, Inc.

Description

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-29

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-91132

EUVD

EUVD-2026-86303

Affected Vendors & Products

Vendor	Product	Version / Range
discourse	discourse	2026.1.8
discourse	discourse	2026.6.3
discourse	discourse	2026.7.2
discourse	discourse	2026.8.0
discourse	discourse	to 2026.1.8 (exc)
discourse	discourse	to 2026.6.3 (exc)
discourse	discourse	to 2026.7.2 (exc)
discourse	discourse	to 2026.8.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability in Discourse allows attackers to bypass wildcard iframe origin allowlists by exploiting URL authority separators. Sites using patterns like https://*.example.com in their iframe allowlist could be tricked into embedding iframes from attacker-controlled domains. The flaw occurs because the wildcard check matches allowed domain text while browsers parse a different origin due to URL manipulation with special characters like @, ?, #, or backslashes.

Detection Guidance

To detect this vulnerability, check if your Discourse instance uses wildcard patterns in the allowed_iframes setting. Review posts or oEmbed responses containing iframe URLs for crafted patterns with authority separators like @, ?, #, or backslashes. Use Discourse admin tools to inspect configured iframe allowlists and test URLs against the patched regex patterns.

Impact Analysis

If exploited, this vulnerability could allow unauthorized iframe embedding from malicious domains. This may lead to integrity issues where attacker-controlled content is rendered on your site, potentially exposing users to phishing, malicious scripts, or other security risks. Successful exploitation requires a site with wildcard iframe allowlists and attacker ability to create posts or trigger oEmbed requests.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized iframe embeds from attacker-controlled domains. If exploited, it may lead to unauthorized data exposure or modification, violating integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Immediately upgrade Discourse to versions 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 or later. Disable wildcard iframe patterns in the allowed_iframes setting if not required. Review and remove any suspicious posts or oEmbed responses containing crafted iframe URLs. Monitor for unauthorized iframe embeds in user-generated content.

Hi! I’m here to help you understand CVE-2026-91132. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70