CVE-2026-91134

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0

Description The post sanitizer allows a stored cross-origin iframe to bypass the allowed iframes prefix policy when the iframe src contains encoded userinfo. This occurs because the sanitizer validates a decoded form differently from the stored iframe src, enabling the browser to interpret an attacker-controlled host while the allowlist check accepts the encoded URL as an allowed prefix. An authenticated user with posting privileges can persist the iframe in a post to render attacker-controlled cross-origin content.

Recommendations Update to version 2026.1.8. Update to version 2026.6.3. Update to version 2026.7.2. Update to version 2026.8.0.