Wildcards in Allowed Iframes of Discourse Discussion Platform Exposes Vulnerability
CVE-2026-91132
What is CVE-2026-91132?
Discourse, an open-source discussion platform, has a security flaw that affects sites using wildcard patterns in the 'allowed_iframes' setting. Prior to the releases of versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, an attacker could exploit this vulnerability by crafting a malicious iframe URL that bypasses the intended restrictions. This occurs because the wildcard origin check matches the allowed domain while allowing an attacker-controlled origin due to improper URL parsing. A user with posting privileges could leverage this flaw through regular posts or create an oEmbed response to serve the malicious iframe. Effective remediation requires upgrading to the specified secure versions.
Affected Version(s)
discourse < 2026.8.0 < 2026.8.0
discourse >= 2026.7.0-latest, < 2026.7.2 < 2026.7.0-latest, 2026.7.2
discourse >= 2026.6.0-latest, < 2026.6.3 < 2026.6.0-latest, 2026.6.3