Discourse Discussion Platform Vulnerability in DomainChecker
CVE-2026-72721

5.3MEDIUM

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72721?

Discourse, an open-source discussion platform, contains a vulnerability in the Onebox::DomainChecker functionality. Versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 handle comparisons of hostnames and blocked domain settings in a case-sensitive manner. This flaw allows attackers to exploit the system by altering the case of characters in redirect target hostnames, effectively circumventing configured domain blocking measures. The issue has been addressed in the specified updated versions, reinforcing the integrity of domain restriction settings.

Affected Version(s)

discourse < 2026.1.6 < 2026.1.6

discourse >= 2026.5.0-latest, < 2026.5.2 < 2026.5.0-latest, 2026.5.2

discourse >= 2026.6.0-latest, < 2026.6.1 < 2026.6.0-latest, 2026.6.1

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM
https://github.com/discourse/discourse/pull/42091
x_refsource_MISC
https://github.com/discourse/discourse/pull/42092
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.