CVE-2026-72728

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

• CWE-20

• https://github.com/discourse/discourse/commit/92eec47e8b477cb8b4ccdb237e26dc1ba8f8b76b
• https://github.com/discourse/discourse/security/advisories/GHSA-qp9j-3v7r-wrvr

Published

Aug 10, 2026

Last Modified

Aug 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72722Discourse is an open-source discussion platform. Prior to 20…4.3
• CVE-2026-72723Discourse is an open-source discussion platform. Prior to 20…5.3
• CVE-2026-72724Discourse is an open-source discussion platform. Prior to 20…4.3
• CVE-2026-72725Discourse is an open-source discussion platform. Prior to 20…5.4
• CVE-2026-72726Discourse is an open-source discussion platform. Prior to 20…6.5
• CVE-2026-72727Discourse is an open-source discussion platform. Prior to 02…4.8
• CVE-2026-72729Discourse is an open-source discussion platform. Prior to 20…2
• CVE-2026-7273A stack-based buffer overflow vulnerability in the CGI progr…8.8
• CVE-2026-72730Discourse is an open-source discussion platform. Prior to 20…8.7
• CVE-2026-72731Discourse is an open-source discussion platform. From 2026.1…7.1
• CVE-2026-72732Discourse is an open-source discussion platform. Prior to 20…4.3
• CVE-2026-72733Dokploy is a free, self-hostable Platform as a Service (PaaS…9.9