CVE-2026-91134 json
Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
published 2026-09-24 45 d ago modified 2026-10-01 39 d ago also BIT-discourse-2026-91134 , EUVD-2026-86298 , GHSA-54vw-chv3-wjpv
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Patch / fix
- bitnami discourse 2026.8.0
- discourse discourse 2026.1.8, 2026.6.3, 2026.7.2, 2026.8.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 41 d ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | <2026.8.0 |
2026.8.0 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/discourse/discourse/pull/42882
web
-
github.com
/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415
web
-
github.com
/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590
web
-
github.com
/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d
web
-
github.com
/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64
web
-
github.com
/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-91134
web
Sources
- CVE List CVE-2026-91134
- NVD CVE-2026-91134
- OSV BIT-discourse-2026-91134
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.