CVE-2026-72721

MediumCVSS 5.3

Published: 10/08/2026(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Summary

Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 in Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing character casing in a redirect target hostname.

Risk Assessment

Bypassing Onebox domain restrictions may allow embedding content from disallowed domains, potentially leading to phishing or injection of malicious content.

Recommendation

Update Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.

Original NVD description (English source)

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing character casing in a redirect target hostname. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.