Discourse defines a forum content platform where users can submit posts that may include embedded URLs. The flaw is an input validation issue in the Onebox allowlist that incorrectly enforces URL origin boundaries, allowing an authenticated user to craft URLs that bypass the allowlist and embed malicious content such as iframes or scripts. The result is that other users viewing the post are exposed to arbitrary script execution in their browsers, consistent with XSS attacks. The CVE description does not provide details about downstream data theft or other exploitation beyond the script injection.

The vulnerability affects Discourse platform installations that are older than the 2026.1.7 release. Versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0‑latest.1 contain the fix. Any installations not yet updated to one of these releases remain vulnerable.

The CVSS base score of 6.3 indicates a moderate risk level. The attack requires the attacker to be authenticated to the forum, after which the attacker can submit the specially crafted URL. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. No additional exploitation outcomes are stated in the CVE description.