CVE-2026-72728CWE-20

CVE-2026-72728

Medium · published August 10, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00313 · 22.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-08-10T21:17Z
References (2)
https://github.com/discourse/discourse/commit/92eec47e8b477cb8b4ccdb237e26dc1ba8f8b76b · [email protected]https://github.com/discourse/discourse/security/advisories/GHSA-qp9j-3v7r-wrvr · [email protected]
EPSS history
Timeline
  • 10 AUG 16:13Z
    Discourse: Onebox iframe origin allowlist enforces URL authority boundary
    cvelistv5