CVE-2026-72721

Published: Aug 10, 2026Modified: Aug 10, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing character casing in a redirect target hostname. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Related CWEs

Improper Handling of Case Sensitivity

The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

References (9)

https://github.com/discourse/discourse/commit/a3e10759fef47f03d450649bb51d9e84f4c68b8f

Source: security-advisories@github.com

https://github.com/discourse/discourse/commit/c2eb6b0e5597d6f28f4be739b83300bc9c69e3cd

Source: security-advisories@github.com

https://github.com/discourse/discourse/commit/caa615c371b1696982ee11ac8f3558f0f8ced584

Source: security-advisories@github.com

https://github.com/discourse/discourse/commit/f503971d311b7b0dfdb751ee8cfd67e8cb99f5c5

Source: security-advisories@github.com

https://github.com/discourse/discourse/pull/42091

Source: security-advisories@github.com

https://github.com/discourse/discourse/pull/42092

Source: security-advisories@github.com

https://github.com/discourse/discourse/pull/42093

Source: security-advisories@github.com

https://github.com/discourse/discourse/pull/42094

Source: security-advisories@github.com

https://github.com/discourse/discourse/security/advisories/GHSA-3x7x-24rq-h5j6

Source: security-advisories@github.com

Timeline

No history available yet.