CVE-2026-91132: Discourse: Wildcard iframe origin allowlist bypass via authority separators
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowediframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.8 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.6.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.7.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.8.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Only sites that have configured wildcard patterns in the allowed_iframes setting are affected. Sites without such wildcard iframe allowlist entries are not described as vulnerable.
What access does an attacker need to exploit this?
The attacker needs posting privileges, or the ability to trigger an oEmbed request for an attacker-controlled URL. They can use a post or a Onebox oEmbed response to render an attacker-controlled iframe.
How can administrators determine whether their site needs remediation?
Review the allowed_iframes setting for wildcard patterns and identify whether untrusted users can create posts or cause Onebox oEmbed requests. Deployments meeting both conditions should upgrade.
Which versions contain the fix?
The issue is fixed in Discourse versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.