Skip to content
Heist/ feed
MediumFix available

Discourse: Wildcard iframe origin allowlist bypass via authority separators

Type: advisorySource: OSV1 source record

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Announced Source revision 1
Original source ↗

BIT-discourse-2026-91132

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:BIT-discourse-2026-91132

discourse

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
2026.8.0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2026.8.0"
          }
        ]
      }
    ],
    "package": {
      "name": "discourse",
      "purl": "pkg:bitnami/discourse",
      "ecosystem": "Bitnami"
    },
    "severity": [
      {
        "type": "CVSS_V3",
        "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
      }
    ],
    "database_specific": {
      "source": "https://github.com/bitnami/vulndb/tree/main/data/discourse/BIT-discourse-2026-91132.json"
    }
  }
]
Related CVEs
CVE-2026-91132

Source reference: /aliases

Publisher severity

medium

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-91132 · Medium

discourse

Event
#59609 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement