CyberRota Analysis
AI-GeneratedAn authenticated user of the Discourse platform can exploit a vulnerability to bypass the Onebox allowlist by submitting specially crafted URLs, potentially embedding malicious content on the site. This could lead to unauthorized content being displayed, impacting the integrity and security of the platform. Organizations using affected versions should prioritize upgrading to versions 2026.1.7 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.