CVE-2026-32113
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Discourse has a vulnerability in the enter action of StaticController that reads the sso_destination_url cookie and redirects to it with allow_other_host: true without validating the destination URL. Cookies are client-controlled and can be set by attackers.
Risk Assessment
An attacker can redirect users to a malicious site, potentially leading to phishing or credential theft.
Recommendation
Update Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0, which contain the fix.
Original NVD description (English source)
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the enter action in StaticController reads the sso_destination_url cookie and redirects to it with allow_other_host: true without validating the destination URL. While this cookie is normally set during legitimate DiscourseConnect Provider flows with cryptographically validated SSO payloads, cookies are client-controlled and can be set by attackers. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.