Discourse’s oEmbed processing mistakenly trusted any attacker-controlled HTML fragment that contained an iframe whose source matched the configured allowlist. This flaw allows a user with posting permission who can control the remote webpage and its oEmbed response to embed their own iframe along with arbitrary sibling HTML or CSS. The stored content then renders in posts, creating misleading or fraudulent user interfaces. The impact is a violation of content integrity and the potential to deceive users, but it does not expose sensitive data or interrupt service availability.

All Discourse installations running versions prior to 2026.9.0, 2026.8.1, 2026.7.3, or 2026.1.9 are affected. The vulnerability is specific to the open-source Discourse discussion platform.

The CVSS score of 7.7 indicates a high-severity flaw; the EPSS score is < 1% (0.00435), and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid posting account, ownership of the fetched webpage and its oEmbed response, and an iframe source that is on the allowlist. Attackers can succeed remotely by controlling the external content that Discourse pulls in, and the stored nature of the injection means that compromised posts persist until content is removed or the system is patched.