CVE-2026-72728

MediumCVSS 6.3

Published: 10/08/2026(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

Discourse, an open-source discussion platform, prior to 2026.1.7 allowed an authenticated user to submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

Risk Assessment

An attacker can embed malicious content on the forum, potentially leading to user attacks, including phishing or malware distribution.

Recommendation

Update Discourse to one of the fixed versions: 2026.1.7, 2026.6.2, 2026.7.1, or 2026.8.0-latest.1.

Original NVD description (English source)

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.