CVE-2026-91134: Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowediframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.8.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Discourse user with permission to create posts can exploit it. They must be able to submit a post containing a crafted iframe source URL with encoded userinfo.
What is the impact on users viewing a malicious post?
The crafted iframe can persist in a post and render attacker-controlled cross-origin content in the viewer's browser. The reported impact is limited confidentiality and integrity impact, with no availability impact.
Are installations using an iframe allowlist affected?
The issue affects the post sanitizer's allowed_iframes prefix policy. A crafted encoded-userinfo URL can pass that policy while the browser resolves the iframe to an attacker-controlled host.
Which Discourse versions contain the fix?
The issue is fixed in Discourse versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.