CVE-2026-91159

7.7High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.7High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity
Weakness: CWE-79

Impact

Authenticated users can inject arbitrary HTML and CSS to create stored phishing overlays or deceptive UI in forum posts. An attacker needs posting permissions, an external webpage they control, and an oEmbed payload referencing an allowlisted iframe domain.

Root cause

The oEmbed processor treated an entire HTML payload as trusted if any contained iframe matched an allowlisted source, failing to sanitize sibling HTML or CSS elements.

Affected systems

Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Fix & remediation

Upgrade Discourse to version 2026.9.0, 2026.8.1, 2026.7.3, or 2026.1.9. No standalone interim mitigation is documented in the advisory.

shell

$ cd /var/discourse && ./launcher rebuild app

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-91159