CVE-2026-91132

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91132
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91132.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91132
Aliases
  • GHSA-4q3q-hph3-3rvp
Published
2026-09-24T16:57:43Z
Modified
2026-09-26T03:48:25Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Discourse: Wildcard iframe origin allowlist bypass via authority separators
Details

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-346"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91132.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
ded677e00beb0e9bae6e70b69582aecfb72b5477
Introduced
06d03da34c4ed09ea59f917f045ba250d2b6320d
Introduced
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Fixed
fb9247e04a826ab8e4d91168b3c4c839ec40bccc
Fixed
3ab62a8397926ed934b667a5db06284c45b4c774
Fixed
777cb880553b517bc9ae502e935a160332e48b78
Fixed
e808d0853e013abf90e648e53ebd606c49ccb19f
Fixed
80968704c1acb1d2ea2c6011dbf6c02ff13238e5
Fixed
d5ae0940707f95da5bc4562f7b544243e3103f8a
Fixed
d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9
Fixed
db8064f2a2a2a3feb3308a1c932ac61d950c9e56
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2026.8.0"
        },
        {
            "introduced":  "2026.7.0-latest"
        },
        {
            "fixed":  "2026.7.2"
        },
        {
            "introduced":  "2026.6.0-latest"
        },
        {
            "fixed":  "2026.6.3"
        },
        {
            "introduced":  "2026.1.0-latest"
        },
        {
            "fixed":  "2026.1.8"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
_gh-attach-assets
esr
stable
v2026.*
v2026.1.0
v2026.1.0-latest
v2026.1.1
v2026.1.2
v2026.1.3
v2026.1.4
v2026.1.5
v2026.1.6
v2026.1.7
v2026.6.0
v2026.6.0-latest
v2026.6.1
v2026.6.2
v2026.7.0
v2026.7.0-latest
v2026.7.1
v2026.8.0-latest
v2026.8.0-latest.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91132.json"