CVE-2026-91132

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0

Description Sites using wildcard patterns in the allowed iframes setting may accept a crafted iframe URL where the allowlisted suffix appears after a URL authority separator. This occurs because the wildcard origin check matches the allowed domain text, but browser URL parsing identifies a different origin controlled by an attacker. A user with posting privileges can exploit this by creating a post or triggering a Onebox oEmbed response, causing an attacker-controlled iframe to render regardless of the allowlisted domain. Exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL.

Recommendations Update to version 2026.1.8. Update to version 2026.6.3. Update to version 2026.7.2. Update to version 2026.8.0.