CVE-2026-91134 in Discourse
Summary
by MITRE • 09/24/2026
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in Discourse prior to the specified patch versions represents a critical failure in input validation logic within the platform's post sanitizer component. This flaw specifically targets the handling of iframe elements embedded within user-generated content, exploiting inconsistencies between how URLs are processed during storage versus how they are validated against security allowlists. The core technical issue stems from a discrepancy in URL decoding and prefix matching mechanisms. When an authenticated user with posting privileges submits a post containing an iframe element, the sanitizer is responsible for ensuring that only approved external domains can be embedded to prevent cross-site scripting or data exfiltration attacks. However, the validation logic fails to account for encoded userinfo components within the source attribute of the iframe tag.
The operational mechanism of this exploit relies on the browser's interpretation of URL encoding versus the server-side sanitization process. An attacker constructs a malicious iframe src attribute that includes an encoded userinfo segment, such as username and password fields embedded in the authority section of the URI scheme. The Discourse sanitizer validates the decoded form of the URL against a whitelist of allowed prefixes. Because the validation occurs on the decoded string, it may incorrectly match an approved domain prefix if the attacker manipulates the encoding to obscure the actual host being loaded. Meanwhile, when the browser renders the stored HTML, it interprets the encoded userinfo differently, potentially resolving the hostname to an attacker-controlled server rather than the intended allowed site. This divergence between the validation state and the runtime execution environment allows malicious cross-origin content to bypass security controls.
The impact of this vulnerability is significant for any instance running affected versions, including 2026.1.8 prior release, 2026.6.3 prior release, 2026.7.2 prior release, and 2026.8.0 prior release. Since the flaw permits stored cross-origin iframe injection, an attacker can persist malicious content within a post that remains visible to other users upon viewing. This enables persistent phishing campaigns where victims are directed to look-alike login pages hosted on external domains under the attacker's control. Furthermore, it facilitates session hijacking or credential theft by leveraging browser trust relationships if the victim is authenticated with services targeted in the attack vector. The ability to render arbitrary cross-origin content also opens avenues for clickjacking attacks and potential data leakage through side-channel information gathering techniques that rely on iframe embedding capabilities.
From a classification perspective, this vulnerability aligns closely with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it falls under the subcategory of stored XSS where malicious scripts or content are permanently stored within target applications. Additionally, the technique of bypassing allowlists through encoding manipulation relates to CWE-601 URL Redirection to Untrusted Site via Open Redirect and CWE-829 Inclusion of Functionality from Untrusted Control Sphere. The exploitation pattern maps directly to MITRE ATT&CK techniques such as T1553 Subvert Trust Controls, which involves bypassing mechanisms that restrict access to resources or functions based on trust relationships, and potentially T1071 Application Layer Protocol if the iframe is used to exfiltrate data via standard web protocols.
Mitigation for this vulnerability requires immediate action by administrators of Discourse instances running any version prior to 2026.8.0. The primary remediation step is to upgrade the software to at least version 2026.1.8, 2026.6.3, 2026.7.2, or preferably the latest stable release which incorporates the fix for this sanitizer logic error. Until upgrades are performed, administrators should consider implementing Web Application Firewall rules that detect and block iframe tags containing encoded userinfo patterns in post bodies. Additionally, enforcing strict Content Security Policy headers can help mitigate some of the impact by restricting frame ancestors and source origins, although server-side validation remains the most effective defense against this specific class of input validation bypasses. Regular security audits and penetration testing focused on HTML sanitization logic are recommended to identify similar discrepancies in other web applications that handle user-generated rich text content.