CVE-2026-72728

Published: Aug 10, 2026Modified: Sep 8, 2026Deferred

6.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.8 / Impact: 3.4

Source: security-advisories@github.com (Secondary)

Description

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://github.com/discourse/discourse/commit/92eec47e8b477cb8b4ccdb237e26dc1ba8f8b76b

Source: security-advisories@github.com

https://github.com/discourse/discourse/security/advisories/GHSA-qp9j-3v7r-wrvr

Source: security-advisories@github.com

Timeline

No history available yet.