Stored iframe content can bypass the Discourse post sanitizer's allowlist when the iframe src contains encoded userinfo. The flaw allows an authenticated user with posting privilege to persist a cross‑origin iframe within a post. When a user opens the post, the browser interprets the attacker‑controlled host, rendering malicious content. This creates a stored cross‑site scripting vector, enabling phishing, defacement, or social‑engineering attacks, and is caused by improper input validation (CWE‑20).

Versions of Discourse prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 are susceptible. An authenticated user can embed a malicious iframe in any post on those installations. The most recent releases listed above contain the fix.

The CVSS score of 5.4 indicates moderate severity. EPSS score is not provided, and the vulnerability is not in the CISA KEV catalog. At least one authenticated user must have posting privileges to create the malicious post; once a target user views the post, the browser loads the attacker‑controlled cross‑origin content. The attack vector is local to the platform, but the impact is on any user who views the post.