Discourse's Onebox feature, which displays rich previews for URLs, checks a configured list of blocked domains to prevent certain external sites from being embedded. The vulnerability arises because the domain check is performed with a case‑sensitive comparison. By altering the letter casing of a redirect target hostname, an attacker can trick the system into treating a blocked domain as allowed, thereby bypassing the blocklist. When the domain is accepted, the Onebox preview will load content from the malicious host, potentially facilitating phishing or the execution of malicious code in users' browsers. This flaw represents a classic case of improper input validation captured by CWE‑178. The impact is that any user with the ability to craft or submit a link can introduce untrusted content into the forum.

The affected product is Discourse, the open source discussion platform. Versions that are affected are any releases prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. All prior releases of Discourse before these specific builds are vulnerable; the patch was incorporated starting with those four releases. The configuration setting controlling the blocklist is SiteSetting.blocked_onebox_domains.

The CVSS base score is 5.3, indicating a moderate severity. EPSS is not available, and the vulnerability is not in CISA’s KEV catalog. An attacker can exploit the flaw simply by posting a link that redirects to a domain with altered casing, and no authentication is required. Because the attack relies on normal forum activity, it carries a relatively high potential for abuse, especially on active installations where users frequently share URLs. Consequently, the risk to affected deployments is significant until the platform is upgraded to a fixed release.