5.4

CVE-2026-91134

Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerdiscourse
≫
Produkt discourse
Version < 2026.8.0
Status affected
Version >= 2026.7.0-latest, < 2026.7.2
Status affected
Version >= 2026.6.0-latest, < 2026.6.3
Status affected
Version >= 2026.1.0-latest, < 2026.1.8
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.107
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/discourse/discourse/pull/42882
https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv
https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415
https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590
https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d
https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64