CVE-2026-91132
Deferred
Deferred - Pending Action
BaseFortify
Vulnerability report for CVE-2026-91132, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-24
Last updated on: 2026-09-24
Assigner: GitHub, Inc.
Description
Description
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | 2026.1.8 |
| discourse | discourse | 2026.6.3 |
| discourse | discourse | 2026.7.2 |
| discourse | discourse | 2026.8.0 |
| discourse | discourse | to 2026.1.8 (exc) |
| discourse | discourse | to 2026.6.3 (exc) |
| discourse | discourse | to 2026.7.2 (exc) |
| discourse | discourse | to 2026.8.0 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-346 | The product does not properly verify that the source of data or communication is valid. |
