CVE-2026-91159

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.9.0 Discourse versions prior to 2026.8.1 Discourse versions prior to 2026.7.3 Discourse versions prior to 2026.1.9

Description An issue exists in oEmbed processing where an entire attacker-controlled HTML fragment is treated as trusted if it contains an iframe with a source matching the configured allowlist. A user with posting permissions who controls a public webpage and its oEmbed response can include unrelated sibling HTML or CSS alongside the allowlisted iframe. This allows the creation of stored visual overlays or styled content within post content, which can be used to create misleading or fraudulent user interfaces. This affects content integrity but does not expose restricted data or disrupt availability.

Recommendations Update to version 2026.9.0. Update to version 2026.8.1. Update to version 2026.7.3. Update to version 2026.1.9.