{"schema_version":"2","view":"grouped","data":[{"id":60446,"cve_ids":["CVE-2026-91121"],"payload":{"kind":"advisory","title":"Discourse: Chat upload filenames rendered as raw HTML in excerpts","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91121","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91121","aliases":["CVE-2026-91121"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:27:43.580Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278","https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787","https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b","https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91121","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:27:35.450393Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:27:43.580Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:05:20.530Z"}}},"related_cves":[{"value":"CVE-2026-91121","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0fd63c65-99ae-4d2a-aa78-957750d08d6b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91121","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91121","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91121","advisory_id":"0fd63c65-99ae-4d2a-aa78-957750d08d6b","event_types":["advisory"],"published_at":"2026-10-25T18:33:56.682713+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T17:05:20.53+00:00","detail_url":"/advisories/advisory%3A0fd63c65-99ae-4d2a-aa78-957750d08d6b","group":{"id":"advisory:0fd63c65-99ae-4d2a-aa78-957750d08d6b","revision":1,"primary_event_id":59652,"change":"published","superseded_by":[],"changed":{"id":59652,"cve_ids":["CVE-2026-91121"],"payload":{"kind":"advisory","title":"Discourse: Chat upload filenames rendered as raw HTML in excerpts","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91121","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91121","aliases":["CVE-2026-91121"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:27:43.580Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278","https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787","https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b","https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91121","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:27:35.450393Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:27:43.580Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:05:20.530Z"}}},"related_cves":[{"value":"CVE-2026-91121","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0fd63c65-99ae-4d2a-aa78-957750d08d6b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91121","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91121","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91121","advisory_id":"0fd63c65-99ae-4d2a-aa78-957750d08d6b","event_types":["advisory"],"published_at":"2026-10-25T18:33:56.682713+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:05:20.53+00:00","detail_url":"/events/59652"},"members":[{"id":59652,"cve_ids":["CVE-2026-91121"],"payload":{"kind":"advisory","title":"Discourse: Chat upload filenames rendered as raw HTML in excerpts","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91121","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91121","aliases":["CVE-2026-91121"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:27:43.580Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278","https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787","https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b","https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91121","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:27:35.450393Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:27:43.580Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:05:20.530Z"}}},"related_cves":[{"value":"CVE-2026-91121","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0fd63c65-99ae-4d2a-aa78-957750d08d6b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91121","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91121","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91121","advisory_id":"0fd63c65-99ae-4d2a-aa78-957750d08d6b","event_types":["advisory"],"published_at":"2026-10-25T18:33:56.682713+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:05:20.53+00:00","detail_url":"/events/59652"}]}},{"id":60438,"cve_ids":["CVE-2026-91133"],"payload":{"kind":"advisory","title":"Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91133","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91133","aliases":["CVE-2026-91133"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:12:50.099Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52","https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f","https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd","https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91133","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:12:40.098136Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:12:50.099Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:53:00.147Z"}}},"related_cves":[{"value":"CVE-2026-91133","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:63f9ca7e-23b5-47e9-99df-71ec6c6acd1b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91133","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91133","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91133","advisory_id":"63f9ca7e-23b5-47e9-99df-71ec6c6acd1b","event_types":["advisory"],"published_at":"2026-10-25T18:33:53.449467+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:53:00.147+00:00","detail_url":"/advisories/advisory%3A63f9ca7e-23b5-47e9-99df-71ec6c6acd1b","group":{"id":"advisory:63f9ca7e-23b5-47e9-99df-71ec6c6acd1b","revision":1,"primary_event_id":59644,"change":"published","superseded_by":[],"changed":{"id":59644,"cve_ids":["CVE-2026-91133"],"payload":{"kind":"advisory","title":"Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91133","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91133","aliases":["CVE-2026-91133"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:12:50.099Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52","https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f","https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd","https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91133","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:12:40.098136Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:12:50.099Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:53:00.147Z"}}},"related_cves":[{"value":"CVE-2026-91133","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:63f9ca7e-23b5-47e9-99df-71ec6c6acd1b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91133","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91133","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91133","advisory_id":"63f9ca7e-23b5-47e9-99df-71ec6c6acd1b","event_types":["advisory"],"published_at":"2026-10-25T18:33:53.449467+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:53:00.147+00:00","detail_url":"/events/59644"},"members":[{"id":59644,"cve_ids":["CVE-2026-91133"],"payload":{"kind":"advisory","title":"Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91133","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91133","aliases":["CVE-2026-91133"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:12:50.099Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52","https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f","https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd","https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91133","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:12:40.098136Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:12:50.099Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:53:00.147Z"}}},"related_cves":[{"value":"CVE-2026-91133","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:63f9ca7e-23b5-47e9-99df-71ec6c6acd1b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91133","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91133","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91133","advisory_id":"63f9ca7e-23b5-47e9-99df-71ec6c6acd1b","event_types":["advisory"],"published_at":"2026-10-25T18:33:53.449467+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:53:00.147+00:00","detail_url":"/events/59644"}]}},{"id":60436,"cve_ids":["CVE-2026-91122"],"payload":{"kind":"advisory","title":"Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91122","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91122","aliases":["CVE-2026-91122"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:25:54.573Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d","https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031","https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda","https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91122","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T17:25:16.666454Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:25:54.573Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:56:26.568Z"}}},"related_cves":[{"value":"CVE-2026-91122","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:65aad389-612d-49b3-8dea-d64c4c819c9a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-91122","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91122","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91122","advisory_id":"65aad389-612d-49b3-8dea-d64c4c819c9a","event_types":["advisory"],"published_at":"2026-10-25T18:33:52.741487+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:56:26.568+00:00","detail_url":"/advisories/advisory%3A65aad389-612d-49b3-8dea-d64c4c819c9a","group":{"id":"advisory:65aad389-612d-49b3-8dea-d64c4c819c9a","revision":1,"primary_event_id":59642,"change":"published","superseded_by":[],"changed":{"id":59642,"cve_ids":["CVE-2026-91122"],"payload":{"kind":"advisory","title":"Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91122","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91122","aliases":["CVE-2026-91122"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:25:54.573Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d","https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031","https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda","https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91122","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T17:25:16.666454Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:25:54.573Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:56:26.568Z"}}},"related_cves":[{"value":"CVE-2026-91122","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:65aad389-612d-49b3-8dea-d64c4c819c9a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-91122","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91122","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91122","advisory_id":"65aad389-612d-49b3-8dea-d64c4c819c9a","event_types":["advisory"],"published_at":"2026-10-25T18:33:52.741487+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:56:26.568+00:00","detail_url":"/events/59642"},"members":[{"id":59642,"cve_ids":["CVE-2026-91122"],"payload":{"kind":"advisory","title":"Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91122","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91122","aliases":["CVE-2026-91122"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:25:54.573Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d","https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031","https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda","https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91122","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T17:25:16.666454Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:25:54.573Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:56:26.568Z"}}},"related_cves":[{"value":"CVE-2026-91122","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:65aad389-612d-49b3-8dea-d64c4c819c9a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-91122","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91122","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91122","advisory_id":"65aad389-612d-49b3-8dea-d64c4c819c9a","event_types":["advisory"],"published_at":"2026-10-25T18:33:52.741487+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:56:26.568+00:00","detail_url":"/events/59642"}]}},{"id":60434,"cve_ids":["CVE-2026-91120"],"payload":{"kind":"advisory","title":"Discourse: Stored HTML injection in video notification emails","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91120","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91120","aliases":["CVE-2026-91120"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:24:59.169Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f","https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3","https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76","https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91120","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:24:51.329319Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:24:59.169Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:00:05.331Z"}}},"related_cves":[{"value":"CVE-2026-91120","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cbfa69e1-e195-423d-b78a-841efa6818a5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91120","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91120","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91120","advisory_id":"cbfa69e1-e195-423d-b78a-841efa6818a5","event_types":["advisory"],"published_at":"2026-10-25T18:33:52.004424+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T17:00:05.331+00:00","detail_url":"/advisories/advisory%3Acbfa69e1-e195-423d-b78a-841efa6818a5","group":{"id":"advisory:cbfa69e1-e195-423d-b78a-841efa6818a5","revision":1,"primary_event_id":59640,"change":"published","superseded_by":[],"changed":{"id":59640,"cve_ids":["CVE-2026-91120"],"payload":{"kind":"advisory","title":"Discourse: Stored HTML injection in video notification emails","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91120","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91120","aliases":["CVE-2026-91120"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:24:59.169Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f","https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3","https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76","https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91120","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:24:51.329319Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:24:59.169Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:00:05.331Z"}}},"related_cves":[{"value":"CVE-2026-91120","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cbfa69e1-e195-423d-b78a-841efa6818a5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91120","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91120","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91120","advisory_id":"cbfa69e1-e195-423d-b78a-841efa6818a5","event_types":["advisory"],"published_at":"2026-10-25T18:33:52.004424+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:00:05.331+00:00","detail_url":"/events/59640"},"members":[{"id":59640,"cve_ids":["CVE-2026-91120"],"payload":{"kind":"advisory","title":"Discourse: Stored HTML injection in video notification emails","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91120","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91120","aliases":["CVE-2026-91120"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:24:59.169Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f","https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3","https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76","https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91120","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:24:51.329319Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:24:59.169Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:00:05.331Z"}}},"related_cves":[{"value":"CVE-2026-91120","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cbfa69e1-e195-423d-b78a-841efa6818a5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91120","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91120","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91120","advisory_id":"cbfa69e1-e195-423d-b78a-841efa6818a5","event_types":["advisory"],"published_at":"2026-10-25T18:33:52.004424+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:00:05.331+00:00","detail_url":"/events/59640"}]}},{"id":60432,"cve_ids":["CVE-2026-84302"],"payload":{"kind":"advisory","title":"Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.","evidence":"cve:CVE-2026-84302","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-84302","aliases":["CVE-2026-84302"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.2,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.7.0"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.1"},{"status":"affected","version":">= 2026.5.0-latest, < 2026.5.2"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.6"}]}],"modified":"2026-09-24T17:04:51.257Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc","https://github.com/discourse/discourse/pull/42091","https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427","https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5","https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd","https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-84302","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:04:31.550424Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:04:51.257Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:49:56.499Z"}}},"related_cves":[{"value":"CVE-2026-84302","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:84252248-8991-4588-94a2-9c7ab53ebbe0","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-84302","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.7.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-84302","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84302","advisory_id":"84252248-8991-4588-94a2-9c7ab53ebbe0","event_types":["advisory"],"published_at":"2026-10-25T18:33:50.755589+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:49:56.499+00:00","detail_url":"/advisories/advisory%3A84252248-8991-4588-94a2-9c7ab53ebbe0","group":{"id":"advisory:84252248-8991-4588-94a2-9c7ab53ebbe0","revision":1,"primary_event_id":59638,"change":"published","superseded_by":[],"changed":{"id":59638,"cve_ids":["CVE-2026-84302"],"payload":{"kind":"advisory","title":"Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.","evidence":"cve:CVE-2026-84302","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-84302","aliases":["CVE-2026-84302"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.2,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.7.0"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.1"},{"status":"affected","version":">= 2026.5.0-latest, < 2026.5.2"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.6"}]}],"modified":"2026-09-24T17:04:51.257Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc","https://github.com/discourse/discourse/pull/42091","https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427","https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5","https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd","https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-84302","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:04:31.550424Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:04:51.257Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:49:56.499Z"}}},"related_cves":[{"value":"CVE-2026-84302","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:84252248-8991-4588-94a2-9c7ab53ebbe0","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-84302","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.7.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-84302","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84302","advisory_id":"84252248-8991-4588-94a2-9c7ab53ebbe0","event_types":["advisory"],"published_at":"2026-10-25T18:33:50.755589+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:49:56.499+00:00","detail_url":"/events/59638"},"members":[{"id":59638,"cve_ids":["CVE-2026-84302"],"payload":{"kind":"advisory","title":"Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.","evidence":"cve:CVE-2026-84302","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-84302","aliases":["CVE-2026-84302"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.2,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.7.0"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.1"},{"status":"affected","version":">= 2026.5.0-latest, < 2026.5.2"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.6"}]}],"modified":"2026-09-24T17:04:51.257Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc","https://github.com/discourse/discourse/pull/42091","https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427","https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5","https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd","https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-84302","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:04:31.550424Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:04:51.257Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:49:56.499Z"}}},"related_cves":[{"value":"CVE-2026-84302","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:84252248-8991-4588-94a2-9c7ab53ebbe0","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-84302","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.7.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-84302","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84302","advisory_id":"84252248-8991-4588-94a2-9c7ab53ebbe0","event_types":["advisory"],"published_at":"2026-10-25T18:33:50.755589+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:49:56.499+00:00","detail_url":"/events/59638"}]}},{"id":60411,"cve_ids":["CVE-2026-91123"],"payload":{"kind":"advisory","title":"Discourse: Reject literal backslash path separators in iframe src traversal guard","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91123","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91123","aliases":["CVE-2026-91123"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:11:34.752Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318","https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24","https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be","https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91123","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:11:25.606443Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:11:34.752Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:54:59.357Z"}}},"related_cves":[{"value":"CVE-2026-91123","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:88d3fc2b-681c-41f7-ae5e-691a116926fe","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-91123","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91123","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91123","advisory_id":"88d3fc2b-681c-41f7-ae5e-691a116926fe","event_types":["advisory"],"published_at":"2026-10-25T18:33:29.778429+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:54:59.357+00:00","detail_url":"/advisories/advisory%3A88d3fc2b-681c-41f7-ae5e-691a116926fe","group":{"id":"advisory:88d3fc2b-681c-41f7-ae5e-691a116926fe","revision":1,"primary_event_id":59612,"change":"published","superseded_by":[],"changed":{"id":59612,"cve_ids":["CVE-2026-91123"],"payload":{"kind":"advisory","title":"Discourse: Reject literal backslash path separators in iframe src traversal guard","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91123","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91123","aliases":["CVE-2026-91123"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:11:34.752Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318","https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24","https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be","https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91123","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:11:25.606443Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:11:34.752Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:54:59.357Z"}}},"related_cves":[{"value":"CVE-2026-91123","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:88d3fc2b-681c-41f7-ae5e-691a116926fe","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-91123","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91123","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91123","advisory_id":"88d3fc2b-681c-41f7-ae5e-691a116926fe","event_types":["advisory"],"published_at":"2026-10-25T18:33:29.778429+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:54:59.357+00:00","detail_url":"/events/59612"},"members":[{"id":59612,"cve_ids":["CVE-2026-91123"],"payload":{"kind":"advisory","title":"Discourse: Reject literal backslash path separators in iframe src traversal guard","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91123","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91123","aliases":["CVE-2026-91123"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-24T17:11:34.752Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318","https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24","https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be","https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91123","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T17:11:25.606443Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:11:34.752Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:54:59.357Z"}}},"related_cves":[{"value":"CVE-2026-91123","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:88d3fc2b-681c-41f7-ae5e-691a116926fe","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-91123","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91123","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91123","advisory_id":"88d3fc2b-681c-41f7-ae5e-691a116926fe","event_types":["advisory"],"published_at":"2026-10-25T18:33:29.778429+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:54:59.357+00:00","detail_url":"/events/59612"}]}},{"id":60409,"cve_ids":["CVE-2026-91132"],"payload":{"kind":"advisory","title":"Discourse: Wildcard iframe origin allowlist bypass via authority separators","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91132","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91132","aliases":["CVE-2026-91132"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-29T02:57:34.925Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5","https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a","https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9","https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91132","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:57:23.434341Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:57:34.925Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:57:43.082Z"}}},"related_cves":[{"value":"CVE-2026-91132","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1186f90c-c94d-40ab-9931-815c12dfab33","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91132","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91132","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91132","advisory_id":"1186f90c-c94d-40ab-9931-815c12dfab33","event_types":["advisory"],"published_at":"2026-10-25T18:33:28.751235+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:57:43.082+00:00","detail_url":"/advisories/advisory%3A1186f90c-c94d-40ab-9931-815c12dfab33","group":{"id":"advisory:1186f90c-c94d-40ab-9931-815c12dfab33","revision":1,"primary_event_id":59610,"change":"published","superseded_by":[],"changed":{"id":59610,"cve_ids":["CVE-2026-91132"],"payload":{"kind":"advisory","title":"Discourse: Wildcard iframe origin allowlist bypass via authority separators","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91132","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91132","aliases":["CVE-2026-91132"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-29T02:57:34.925Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5","https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a","https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9","https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91132","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:57:23.434341Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:57:34.925Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:57:43.082Z"}}},"related_cves":[{"value":"CVE-2026-91132","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1186f90c-c94d-40ab-9931-815c12dfab33","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91132","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91132","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91132","advisory_id":"1186f90c-c94d-40ab-9931-815c12dfab33","event_types":["advisory"],"published_at":"2026-10-25T18:33:28.751235+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:57:43.082+00:00","detail_url":"/events/59610"},"members":[{"id":59610,"cve_ids":["CVE-2026-91132"],"payload":{"kind":"advisory","title":"Discourse: Wildcard iframe origin allowlist bypass via authority separators","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91132","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91132","aliases":["CVE-2026-91132"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-29T02:57:34.925Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5","https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a","https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9","https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91132","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:57:23.434341Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:57:34.925Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:57:43.082Z"}}},"related_cves":[{"value":"CVE-2026-91132","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1186f90c-c94d-40ab-9931-815c12dfab33","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91132","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91132","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91132","advisory_id":"1186f90c-c94d-40ab-9931-815c12dfab33","event_types":["advisory"],"published_at":"2026-10-25T18:33:28.751235+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:57:43.082+00:00","detail_url":"/events/59610"}]}},{"id":60403,"cve_ids":["CVE-2026-91134"],"payload":{"kind":"advisory","title":"Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91134","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91134","aliases":["CVE-2026-91134"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-29T02:56:30.376Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415","https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590","https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d","https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91134","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:56:20.350456Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:56:30.376Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:51:34.057Z"}}},"related_cves":[{"value":"CVE-2026-91134","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:06641605-0f52-4626-88bc-44653c6a0e03","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91134","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91134","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91134","advisory_id":"06641605-0f52-4626-88bc-44653c6a0e03","event_types":["advisory"],"published_at":"2026-10-25T18:33:26.882235+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:51:34.057+00:00","detail_url":"/advisories/advisory%3A06641605-0f52-4626-88bc-44653c6a0e03","group":{"id":"advisory:06641605-0f52-4626-88bc-44653c6a0e03","revision":1,"primary_event_id":59606,"change":"published","superseded_by":[],"changed":{"id":59606,"cve_ids":["CVE-2026-91134"],"payload":{"kind":"advisory","title":"Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91134","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91134","aliases":["CVE-2026-91134"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-29T02:56:30.376Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415","https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590","https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d","https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91134","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:56:20.350456Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:56:30.376Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:51:34.057Z"}}},"related_cves":[{"value":"CVE-2026-91134","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:06641605-0f52-4626-88bc-44653c6a0e03","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91134","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91134","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91134","advisory_id":"06641605-0f52-4626-88bc-44653c6a0e03","event_types":["advisory"],"published_at":"2026-10-25T18:33:26.882235+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:51:34.057+00:00","detail_url":"/events/59606"},"members":[{"id":59606,"cve_ids":["CVE-2026-91134"],"payload":{"kind":"advisory","title":"Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91134","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91134","aliases":["CVE-2026-91134"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-29T02:56:30.376Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415","https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590","https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d","https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91134","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:56:20.350456Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:56:30.376Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:51:34.057Z"}}},"related_cves":[{"value":"CVE-2026-91134","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:06641605-0f52-4626-88bc-44653c6a0e03","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91134","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91134","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91134","advisory_id":"06641605-0f52-4626-88bc-44653c6a0e03","event_types":["advisory"],"published_at":"2026-10-25T18:33:26.882235+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T16:51:34.057+00:00","detail_url":"/events/59606"}]}},{"id":60395,"cve_ids":["CVE-2026-91119"],"payload":{"kind":"advisory","title":"Discourse: Encode action_code_who in mention URLs","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91119","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91119","aliases":["CVE-2026-91119"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-28T15:00:02.275Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c","https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035","https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a","https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91119","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T14:59:51.871193Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T15:00:02.275Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:07:04.367Z"}}},"related_cves":[{"value":"CVE-2026-91119","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:47a0ee0c-c248-48e0-88be-0517a3815af6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91119","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91119","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91119","advisory_id":"47a0ee0c-c248-48e0-88be-0517a3815af6","event_types":["advisory"],"published_at":"2026-10-25T18:33:23.311704+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T17:07:04.367+00:00","detail_url":"/advisories/advisory%3A47a0ee0c-c248-48e0-88be-0517a3815af6","group":{"id":"advisory:47a0ee0c-c248-48e0-88be-0517a3815af6","revision":1,"primary_event_id":59598,"change":"published","superseded_by":[],"changed":{"id":59598,"cve_ids":["CVE-2026-91119"],"payload":{"kind":"advisory","title":"Discourse: Encode action_code_who in mention URLs","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91119","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91119","aliases":["CVE-2026-91119"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-28T15:00:02.275Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c","https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035","https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a","https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91119","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T14:59:51.871193Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T15:00:02.275Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:07:04.367Z"}}},"related_cves":[{"value":"CVE-2026-91119","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:47a0ee0c-c248-48e0-88be-0517a3815af6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91119","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91119","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91119","advisory_id":"47a0ee0c-c248-48e0-88be-0517a3815af6","event_types":["advisory"],"published_at":"2026-10-25T18:33:23.311704+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:07:04.367+00:00","detail_url":"/events/59598"},"members":[{"id":59598,"cve_ids":["CVE-2026-91119"],"payload":{"kind":"advisory","title":"Discourse: Encode action_code_who in mention URLs","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.","evidence":"cve:CVE-2026-91119","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-91119","aliases":["CVE-2026-91119"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.8.0"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.2"},{"status":"affected","version":">= 2026.6.0-latest, < 2026.6.3"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.8"}]}],"modified":"2026-09-28T15:00:02.275Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3","https://github.com/discourse/discourse/pull/42882","https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c","https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035","https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a","https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91119","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T14:59:51.871193Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T15:00:02.275Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:07:04.367Z"}}},"related_cves":[{"value":"CVE-2026-91119","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:47a0ee0c-c248-48e0-88be-0517a3815af6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-91119","metrics":[],"products":[{"name":{"value":"discourse","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2026.8.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-discourse-2026-91119","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91119","advisory_id":"47a0ee0c-c248-48e0-88be-0517a3815af6","event_types":["advisory"],"published_at":"2026-10-25T18:33:23.311704+00:00","technologies":["core-cve","discourse"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:07:04.367+00:00","detail_url":"/events/59598"}]}},{"id":50625,"cve_ids":["CVE-2017-20290"],"payload":{"kind":"advisory","title":"Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed","summary":"Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","evidence":"cve:CVE-2017-20290","products":[{"name":{"value":"Discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2017-20290","aliases":["CVE-2017-20290"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/discourse/discourse","vendor":"Discourse","product":"Discourse","versions":[{"status":"affected","version":"1.9.0.beta2","lessThan":"1.9.0.beta13","versionType":"custom"}],"packageURL":"pkg:github/discourse/discourse","defaultStatus":"unaffected"}],"modified":"2026-10-22T10:57:24.711Z","provider":"cve","references":["https://github.com/discourse/discourse/commit/a6f2533d38","https://github.com/discourse/discourse/commit/6e37f09b19","https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/discourse-xss.yaml","https://www.vulncheck.com/advisories/discourse-1.9.0-beta13-reflected-xss-via-email-unsubscribed"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T10:57:24.711Z"}}},"related_cves":[{"value":"CVE-2017-20290","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2cce70f4-965d-4663-86f4-cf34a2d1aa15","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-20290","advisory_id":"2cce70f4-965d-4663-86f4-cf34a2d1aa15","event_types":["advisory"],"published_at":"2026-10-25T14:02:05.191471+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T10:57:24.711+00:00","detail_url":"/advisories/advisory%3A2cce70f4-965d-4663-86f4-cf34a2d1aa15","group":{"id":"advisory:2cce70f4-965d-4663-86f4-cf34a2d1aa15","revision":1,"primary_event_id":50153,"change":"published","superseded_by":[],"changed":{"id":50153,"cve_ids":["CVE-2017-20290"],"payload":{"kind":"advisory","title":"Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed","summary":"Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","evidence":"cve:CVE-2017-20290","products":[{"name":{"value":"Discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2017-20290","aliases":["CVE-2017-20290"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/discourse/discourse","vendor":"Discourse","product":"Discourse","versions":[{"status":"affected","version":"1.9.0.beta2","lessThan":"1.9.0.beta13","versionType":"custom"}],"packageURL":"pkg:github/discourse/discourse","defaultStatus":"unaffected"}],"modified":"2026-10-22T10:57:24.711Z","provider":"cve","references":["https://github.com/discourse/discourse/commit/a6f2533d38","https://github.com/discourse/discourse/commit/6e37f09b19","https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/discourse-xss.yaml","https://www.vulncheck.com/advisories/discourse-1.9.0-beta13-reflected-xss-via-email-unsubscribed"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T10:57:24.711Z"}}},"related_cves":[{"value":"CVE-2017-20290","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2cce70f4-965d-4663-86f4-cf34a2d1aa15","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-20290","advisory_id":"2cce70f4-965d-4663-86f4-cf34a2d1aa15","event_types":["advisory"],"published_at":"2026-10-25T14:02:05.191471+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T10:57:24.711+00:00","detail_url":"/events/50153"},"members":[{"id":50153,"cve_ids":["CVE-2017-20290"],"payload":{"kind":"advisory","title":"Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed","summary":"Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","evidence":"cve:CVE-2017-20290","products":[{"name":{"value":"Discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2017-20290","aliases":["CVE-2017-20290"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/discourse/discourse","vendor":"Discourse","product":"Discourse","versions":[{"status":"affected","version":"1.9.0.beta2","lessThan":"1.9.0.beta13","versionType":"custom"}],"packageURL":"pkg:github/discourse/discourse","defaultStatus":"unaffected"}],"modified":"2026-10-22T10:57:24.711Z","provider":"cve","references":["https://github.com/discourse/discourse/commit/a6f2533d38","https://github.com/discourse/discourse/commit/6e37f09b19","https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/discourse-xss.yaml","https://www.vulncheck.com/advisories/discourse-1.9.0-beta13-reflected-xss-via-email-unsubscribed"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-22T10:57:24.711Z"}}},"related_cves":[{"value":"CVE-2017-20290","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2cce70f4-965d-4663-86f4-cf34a2d1aa15","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-20290","advisory_id":"2cce70f4-965d-4663-86f4-cf34a2d1aa15","event_types":["advisory"],"published_at":"2026-10-25T14:02:05.191471+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T10:57:24.711+00:00","detail_url":"/events/50153"}]}},{"id":42456,"cve_ids":["CVE-2026-91159"],"payload":{"kind":"advisory","title":"Discourse: Stored oEmbed HTML injection via allowed iframe","summary":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.","evidence":"cve:CVE-2026-91159","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91159","aliases":["CVE-2026-91159"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.1.9"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.3"},{"status":"affected","version":">= 2026.8.0-latest, < 2026.8.1"},{"status":"affected","version":">= 2026.9.0-latest, < 2026.9.0"}]}],"modified":"2026-10-20T01:33:56.005Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-f9jx-vv33-4282","https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22","https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a","https://github.com/discourse/discourse/commit/dde8bc4fb6200139f5eff7e100b0f3e829d37ab3","https://github.com/discourse/discourse/commit/ed6f83f123d1a4c6c6c7e64c8a2233e3cb6a28d7"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91159","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T01:33:46.177897Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T01:33:56.005Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T15:30:14.190Z"}}},"related_cves":[{"value":"CVE-2026-91159","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:20fa788a-fa19-4d9c-85ab-8b919bee1608","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91159","advisory_id":"20fa788a-fa19-4d9c-85ab-8b919bee1608","event_types":["advisory"],"published_at":"2026-10-25T11:38:43.167366+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T15:30:14.19+00:00","detail_url":"/advisories/advisory%3A20fa788a-fa19-4d9c-85ab-8b919bee1608","group":{"id":"advisory:20fa788a-fa19-4d9c-85ab-8b919bee1608","revision":1,"primary_event_id":42065,"change":"published","superseded_by":[],"changed":{"id":42065,"cve_ids":["CVE-2026-91159"],"payload":{"kind":"advisory","title":"Discourse: Stored oEmbed HTML injection via allowed iframe","summary":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.","evidence":"cve:CVE-2026-91159","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91159","aliases":["CVE-2026-91159"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.1.9"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.3"},{"status":"affected","version":">= 2026.8.0-latest, < 2026.8.1"},{"status":"affected","version":">= 2026.9.0-latest, < 2026.9.0"}]}],"modified":"2026-10-20T01:33:56.005Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-f9jx-vv33-4282","https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22","https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a","https://github.com/discourse/discourse/commit/dde8bc4fb6200139f5eff7e100b0f3e829d37ab3","https://github.com/discourse/discourse/commit/ed6f83f123d1a4c6c6c7e64c8a2233e3cb6a28d7"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91159","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T01:33:46.177897Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T01:33:56.005Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T15:30:14.190Z"}}},"related_cves":[{"value":"CVE-2026-91159","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:20fa788a-fa19-4d9c-85ab-8b919bee1608","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91159","advisory_id":"20fa788a-fa19-4d9c-85ab-8b919bee1608","event_types":["advisory"],"published_at":"2026-10-25T11:38:43.167366+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T15:30:14.19+00:00","detail_url":"/events/42065"},"members":[{"id":42065,"cve_ids":["CVE-2026-91159"],"payload":{"kind":"advisory","title":"Discourse: Stored oEmbed HTML injection via allowed iframe","summary":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.","evidence":"cve:CVE-2026-91159","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91159","aliases":["CVE-2026-91159"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.1.9"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.3"},{"status":"affected","version":">= 2026.8.0-latest, < 2026.8.1"},{"status":"affected","version":">= 2026.9.0-latest, < 2026.9.0"}]}],"modified":"2026-10-20T01:33:56.005Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-f9jx-vv33-4282","https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22","https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a","https://github.com/discourse/discourse/commit/dde8bc4fb6200139f5eff7e100b0f3e829d37ab3","https://github.com/discourse/discourse/commit/ed6f83f123d1a4c6c6c7e64c8a2233e3cb6a28d7"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91159","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T01:33:46.177897Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T01:33:56.005Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T15:30:14.190Z"}}},"related_cves":[{"value":"CVE-2026-91159","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:20fa788a-fa19-4d9c-85ab-8b919bee1608","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91159","advisory_id":"20fa788a-fa19-4d9c-85ab-8b919bee1608","event_types":["advisory"],"published_at":"2026-10-25T11:38:43.167366+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T15:30:14.19+00:00","detail_url":"/events/42065"}]}},{"id":42453,"cve_ids":["CVE-2026-91157"],"payload":{"kind":"advisory","title":"Discourse: Media uploads remain publicly accessible after category permissions are restricted","summary":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.","evidence":"cve:CVE-2026-91157","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91157","aliases":["CVE-2026-91157"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.1.9"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.3"},{"status":"affected","version":">= 2026.8.0-latest, < 2026.8.1"},{"status":"affected","version":">= 2026.9.0-latest, < 2026.9.0"}]}],"modified":"2026-10-20T01:35:25.492Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-298h-xgw6-4pv3","https://github.com/discourse/discourse/commit/16017732981fdb3ee65d7b3c69c573610bf02aab","https://github.com/discourse/discourse/commit/83f5f9f1df7ddc79ec0950e1b2038ba659635708","https://github.com/discourse/discourse/commit/98f1c021d0e956cded5239a5d8a6afe2b9e1b7e7","https://github.com/discourse/discourse/commit/b2fb98394b2636b29e850f06b0029f8ca8b48458"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91157","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T01:35:15.783931Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T01:35:25.492Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T15:37:02.240Z"}}},"related_cves":[{"value":"CVE-2026-91157","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6ff1f175-422f-4f6f-969c-b75db23adc51","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91157","advisory_id":"6ff1f175-422f-4f6f-969c-b75db23adc51","event_types":["advisory"],"published_at":"2026-10-25T11:38:41.302528+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T15:37:02.24+00:00","detail_url":"/advisories/advisory%3A6ff1f175-422f-4f6f-969c-b75db23adc51","group":{"id":"advisory:6ff1f175-422f-4f6f-969c-b75db23adc51","revision":1,"primary_event_id":42062,"change":"published","superseded_by":[],"changed":{"id":42062,"cve_ids":["CVE-2026-91157"],"payload":{"kind":"advisory","title":"Discourse: Media uploads remain publicly accessible after category permissions are restricted","summary":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.","evidence":"cve:CVE-2026-91157","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91157","aliases":["CVE-2026-91157"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.1.9"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.3"},{"status":"affected","version":">= 2026.8.0-latest, < 2026.8.1"},{"status":"affected","version":">= 2026.9.0-latest, < 2026.9.0"}]}],"modified":"2026-10-20T01:35:25.492Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-298h-xgw6-4pv3","https://github.com/discourse/discourse/commit/16017732981fdb3ee65d7b3c69c573610bf02aab","https://github.com/discourse/discourse/commit/83f5f9f1df7ddc79ec0950e1b2038ba659635708","https://github.com/discourse/discourse/commit/98f1c021d0e956cded5239a5d8a6afe2b9e1b7e7","https://github.com/discourse/discourse/commit/b2fb98394b2636b29e850f06b0029f8ca8b48458"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91157","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T01:35:15.783931Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T01:35:25.492Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T15:37:02.240Z"}}},"related_cves":[{"value":"CVE-2026-91157","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6ff1f175-422f-4f6f-969c-b75db23adc51","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91157","advisory_id":"6ff1f175-422f-4f6f-969c-b75db23adc51","event_types":["advisory"],"published_at":"2026-10-25T11:38:41.302528+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T15:37:02.24+00:00","detail_url":"/events/42062"},"members":[{"id":42062,"cve_ids":["CVE-2026-91157"],"payload":{"kind":"advisory","title":"Discourse: Media uploads remain publicly accessible after category permissions are restricted","summary":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.","evidence":"cve:CVE-2026-91157","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91157","aliases":["CVE-2026-91157"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.1.9"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.3"},{"status":"affected","version":">= 2026.8.0-latest, < 2026.8.1"},{"status":"affected","version":">= 2026.9.0-latest, < 2026.9.0"}]}],"modified":"2026-10-20T01:35:25.492Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-298h-xgw6-4pv3","https://github.com/discourse/discourse/commit/16017732981fdb3ee65d7b3c69c573610bf02aab","https://github.com/discourse/discourse/commit/83f5f9f1df7ddc79ec0950e1b2038ba659635708","https://github.com/discourse/discourse/commit/98f1c021d0e956cded5239a5d8a6afe2b9e1b7e7","https://github.com/discourse/discourse/commit/b2fb98394b2636b29e850f06b0029f8ca8b48458"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91157","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T01:35:15.783931Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T01:35:25.492Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T15:37:02.240Z"}}},"related_cves":[{"value":"CVE-2026-91157","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6ff1f175-422f-4f6f-969c-b75db23adc51","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91157","advisory_id":"6ff1f175-422f-4f6f-969c-b75db23adc51","event_types":["advisory"],"published_at":"2026-10-25T11:38:41.302528+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T15:37:02.24+00:00","detail_url":"/events/42062"}]}},{"id":23034,"cve_ids":["CVE-2026-91156"],"payload":{"kind":"advisory","title":"Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users","summary":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.","evidence":"cve:CVE-2026-91156","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91156","aliases":["CVE-2026-91156"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.1.9"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.3"},{"status":"affected","version":">= 2026.8.0-latest, < 2026.8.1"},{"status":"affected","version":">= 2026.9.0-latest, < 2026.9.0"}]}],"modified":"2026-10-14T17:42:03.003Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-gh4f-qr62-vx8q","https://github.com/discourse/discourse/commit/046fb7bfd68a5b95e63dda88c3c73877c5cf9d5e","https://github.com/discourse/discourse/commit/87b31bf60a7827f075634254379a1dcbaba409cb","https://github.com/discourse/discourse/commit/ba74bb404ab4439f5b1f0204e848d62099db8ae1","https://github.com/discourse/discourse/commit/cac1f26f275cec3dc1dd51dfdac2b3d1a4ec50f8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91156","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T17:41:47.693023Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T17:42:03.003Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T15:33:33.121Z"}}},"related_cves":[{"value":"CVE-2026-91156","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0c04b3be-cedf-4acf-b3ae-4b9f82e1e788","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91156","advisory_id":"0c04b3be-cedf-4acf-b3ae-4b9f82e1e788","event_types":["advisory"],"published_at":"2026-10-25T06:09:32.345769+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T15:33:33.121+00:00","detail_url":"/advisories/advisory%3A0c04b3be-cedf-4acf-b3ae-4b9f82e1e788","group":{"id":"advisory:0c04b3be-cedf-4acf-b3ae-4b9f82e1e788","revision":1,"primary_event_id":22868,"change":"published","superseded_by":[],"changed":{"id":22868,"cve_ids":["CVE-2026-91156"],"payload":{"kind":"advisory","title":"Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users","summary":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.","evidence":"cve:CVE-2026-91156","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91156","aliases":["CVE-2026-91156"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.1.9"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.3"},{"status":"affected","version":">= 2026.8.0-latest, < 2026.8.1"},{"status":"affected","version":">= 2026.9.0-latest, < 2026.9.0"}]}],"modified":"2026-10-14T17:42:03.003Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-gh4f-qr62-vx8q","https://github.com/discourse/discourse/commit/046fb7bfd68a5b95e63dda88c3c73877c5cf9d5e","https://github.com/discourse/discourse/commit/87b31bf60a7827f075634254379a1dcbaba409cb","https://github.com/discourse/discourse/commit/ba74bb404ab4439f5b1f0204e848d62099db8ae1","https://github.com/discourse/discourse/commit/cac1f26f275cec3dc1dd51dfdac2b3d1a4ec50f8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91156","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T17:41:47.693023Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T17:42:03.003Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T15:33:33.121Z"}}},"related_cves":[{"value":"CVE-2026-91156","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0c04b3be-cedf-4acf-b3ae-4b9f82e1e788","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91156","advisory_id":"0c04b3be-cedf-4acf-b3ae-4b9f82e1e788","event_types":["advisory"],"published_at":"2026-10-25T06:09:32.345769+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T15:33:33.121+00:00","detail_url":"/events/22868"},"members":[{"id":22868,"cve_ids":["CVE-2026-91156"],"payload":{"kind":"advisory","title":"Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users","summary":"Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.","evidence":"cve:CVE-2026-91156","products":[{"name":{"value":"discourse","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-91156","aliases":["CVE-2026-91156"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"discourse","product":"discourse","versions":[{"status":"affected","version":"< 2026.1.9"},{"status":"affected","version":">= 2026.7.0-latest, < 2026.7.3"},{"status":"affected","version":">= 2026.8.0-latest, < 2026.8.1"},{"status":"affected","version":">= 2026.9.0-latest, < 2026.9.0"}]}],"modified":"2026-10-14T17:42:03.003Z","provider":"cve","references":["https://github.com/discourse/discourse/security/advisories/GHSA-gh4f-qr62-vx8q","https://github.com/discourse/discourse/commit/046fb7bfd68a5b95e63dda88c3c73877c5cf9d5e","https://github.com/discourse/discourse/commit/87b31bf60a7827f075634254379a1dcbaba409cb","https://github.com/discourse/discourse/commit/ba74bb404ab4439f5b1f0204e848d62099db8ae1","https://github.com/discourse/discourse/commit/cac1f26f275cec3dc1dd51dfdac2b3d1a4ec50f8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91156","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T17:41:47.693023Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T17:42:03.003Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-14T15:33:33.121Z"}}},"related_cves":[{"value":"CVE-2026-91156","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0c04b3be-cedf-4acf-b3ae-4b9f82e1e788","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91156","advisory_id":"0c04b3be-cedf-4acf-b3ae-4b9f82e1e788","event_types":["advisory"],"published_at":"2026-10-25T06:09:32.345769+00:00","technologies":["core-cve","discourse"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-14T15:33:33.121+00:00","detail_url":"/events/22868"}]}}],"next_after":60446,"next_before":23034}