CVE-2026-91159

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

• CWE-79

• https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22
• https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a
• https://github.com/discourse/discourse/commit/dde8bc4fb6200139f5eff7e100b0f3e829d37ab3
• https://github.com/discourse/discourse/commit/ed6f83f123d1a4c6c6c7e64c8a2233e3cb6a28d7
• https://github.com/discourse/discourse/security/advisories/GHSA-f9jx-vv33-4282

Published

Oct 14, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91147A flaw was found in `cockpit-ws`. This vulnerability allows …5.9
• CVE-2026-91149A flaw was found in Cockpit. An unauthenticated remote attac…7.5
• CVE-2026-9115Insufficient policy enforcement in Service Worker in Google …4.3
• CVE-2026-91154Missing Authentication for Critical Function (CWE-306) in th…6.9
• CVE-2026-91156Discourse is an open-source discussion platform. Prior to 20…7.5
• CVE-2026-91157Discourse is an open-source discussion platform. Prior to 20…7.5
• CVE-2026-9116Insufficient policy enforcement in ServiceWorker in Google C…4.3
• CVE-2026-91160OpenWA is a free, open source, self-hosted WhatsApp API gate…8.2
• CVE-2026-91161OpenWA is a free, open source, self-hosted WhatsApp API gate…6.4
• CVE-2026-91164Warpgate is an open source SSH, HTTPS and MySQL bastion host…4.3
• CVE-2026-91165Warpgate is an open source SSH, HTTPS and MySQL bastion host…2.4
• CVE-2026-91166Warpgate is an open source SSH, HTTPS and MySQL bastion host…5.7