CVE-2026-72720

Executive Summary

CVE-2026-72720 is an HTML injection vulnerability in Discourse, an open-source discussion platform, affecting the PrettyText.format_for_email email-generation path. Discourse instances running versions prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1 are affected. A low-privileged authenticated user can craft post content — via Vimeo iframe sources, secure-upload URLs or dimensions, or hashtag data-slug values — such that cooked attribute values are reparsed as HTML markup in notification emails, enabling stored HTML injection that impacts all email recipients (CVSS 6.4, scope changed). No public PoC, exploit code, or in-the-wild exploitation has been reported as of this writing, and the patch is claimed by a single source (OSV) but not independently confirmed.

Technical Analysis

The vulnerability resides in the conversion routine used by Discourse to transform cooked (processed) post HTML into email-ready HTML. The root cause is a double-interpretation flaw: cooked attribute values are taken from the final HTML representation and reparsed as markup instead of being treated as opaque text. When the converter encounters an attribute whose decoded value contains characters resembling HTML tags or entities, the reparse promotes that text into live markup in the generated email body.

The NVD description identifies three concrete trigger vectors:

1. Crafted Vimeo iframe sources — The conversion routine is designed to recognize and convert Vimeo embeds into a mail-safe format. Because the routine fails to strictly validate the iframe host and path, iframes pointing to non-Vimeo (or otherwise non-allowlisted) origins can be converted. The src attribute value itself can be manipulated so that after decoding, it contains markup that is reparsed as HTML.

2. Secure-upload URLs or dimensions — Upload embeds include attributes such as the source URL and width/height dimensions. When these attribute values are reprocessed by PrettyText.format_for_email, crafted values can inject additional HTML elements rather than being emitted as plain attribute text.

3. Hashtag data-slug values — Hashtag links carry a data-slug attribute. A crafted slug value containing decoded markup can be reinterpreted as tags during the email conversion, producing HTML injection in the email body.

From a code-path perspective, the flaw is a classic sanitization/encoding mismatch: one processing stage decodes or emits attribute text, and the subsequent stage assumes that text is inert and runs it through a markup parser. This class of bug is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation), which covers both reflected/stored XSS and HTML injection. The injection executes in the context of the email recipient's mail client rather than the Discourse web application, which is why the CVSS vector records a scope change (S:C): the vulnerable component is the Discourse server-side email renderer, while the impacted component is the recipient's mail client.

Public technical details are limited to the NVD description; no code-level proof-of-concept, diff, or advisory details beyond the OSV version listing were available at the time of writing. Consequently, the exact function-level implementation of the flawed reparse cannot be described with confidence, and the analysis above is grounded in the vulnerability class and the named attribute vectors (data-slug, iframe src, upload dimensions/URL).

Exploitation Scenarios

No public PoC or exploit code has been identified for CVE-2026-72720. The attack chain below is inferred from the vulnerability class described in the NVD entry and should not be treated as a confirmed exploit sequence.

1. Reconnaissance / target identification — An attacker identifies an Internet-facing Discourse instance running a vulnerable version. This can be performed via general-purpose search engines (e.g., Shodan queries for Discourse banners and titles) or by observing the Discourse version string available to unauthenticated users. The attacker then registers or compromises a low-privileged account (PR:L), which on most Discourse deployments is sufficient to create topics, replies, and posts.

2. Trigger of the flaw — The attacker composes a post that includes one of the vulnerable constructs: a crafted Vimeo iframe whose src attribute evades the allowlist validation, a secure-upload embed with malicious URL/dimension attributes, or a hashtag whose data-slug value contains markup-like text. The post is saved and cooked into HTML; the malicious content persists server-side as part of the topic.

3. Payload / execution method — When Discourse generates notification emails (new post, reply notification, mention, etc.) for other users, PrettyText.format_for_email processes the cooked HTML. During this conversion, the crafted attribute value is decoded and reparsed as markup. The payload is therefore an HTML string placed inside an attribute value — for example, markup that, after reparse, becomes an injected <img> element, link, form, or other HTML construct inside the email body. Because this is HTML injection rather than script execution in the web application context, the practical effect depends on the mail client's HTML rendering capabilities.

4. Post-exploitation impact — Recipients who open the malicious email render the injected HTML. Common abuse scenarios include phishing lures (fake login forms or banners), embedded tracking beacons that leak recipient information, and link manipulation that redirects users to attacker-controlled sites. The attacker gains a low-impact confidentiality and integrity foothold (CVSS C:L, I:L) that extends into every mail client of affected forum participants, with no requirement for user interaction on the forum side (UI:N).

Because the injection is stored in the topic content and replayed across every generated email, the reach is broad: any user subscribed to or participating in the poisoned topic receives the malicious email. The lack of a public PoC means real-world exploitation progress is unconfirmed, but the attack surface is realistic for forums that allow low-privileged posting.

Impact Assessment

Business impact — Discourse powers public communities, customer support forums, and internal collaboration spaces. An HTML injection that poisons notification emails can be used to deliver phishing content under the trust domain of the organization's forum, undermining brand trust and potentially leading to credential theft from community members. The attack requires only a standard user account, making it accessible to a large population of low-trust actors in public deployments.

Affected systems — Self-hosted Discourse instances running any version prior to 2026.1.7, 2026.6.2, 2026.7.1, or 2026.8.0-latest.1. Discourse-managed hosting (discourse.org) is presumed patched when the listed fixed versions are deployed, but this is not explicitly confirmed in the provided data. The OSV package data lists multiple commit/version nodes, indicating the fix spans several release branches.

Blast radius — The scope change (S:C) in the CVSS vector indicates the security impact extends beyond the Discourse server to recipients' mail clients. One crafted post can poison emails generated for every subscriber, participant, and follower of the topic — a one-to-many amplification. The confidentiality (C:L) and integrity (I:L) ratings reflect that the injected content can leak limited information (e.g., via injected resource loads) and alter what is displayed, but cannot compromise the mail client's host or the Discourse server. No availability impact (A:N) is present.

Exploitation likelihood — The EPSS score of 0.00299 (22.5th percentile) indicates a low probability of exploitation in the near term, and the CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the low complexity (AC:L) and low privilege requirement (PR:L) make this an attractive candidate for incorporation into wider phishing frameworks if a reliable PoC is published.

Detection Guidance

Detection for this vulnerability is primarily possible at two layers: the web application layer (HTTP POST requests containing malicious attribute content) and the mail gateway layer (emails containing injected HTML derived from Discourse notification templates). The rules below target the web layer, as the vulnerable attributes (data-slug, iframe src, upload dimensions) are observable in request bodies. Adjust field names to match your local log normalization.

Sigma Rule

title: Possible Discourse PrettyText HTML Injection Attempt (CVE-2026-72720)
id: 7f2a6b4e-9c35-4d8a-b6e1-3c5f2d8a9c40
status: experimental
description: Detects POST requests to a Discourse instance containing crafted attribute values that may be reparsed as HTML by PrettyText.format_for_email.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72720
author: Valters IT Threat Intelligence
date: 2026/02/01
logsource:
    category: webserver
    product: discourse
detection:
    selection_body:
        cs_method: 'POST'
        cs_uri_query|contains:
            - 'data-slug'
            - 'iframe'
    selection_payload:
        cs-uri-query|contains|all:
            - '<'
            - '>'
        cs-uri-query|contains:
            - '<script'
            - '<img'
            - 'onerror'
            - 'javascript:'
    selection_vimeo_bypass:
        cs-uri-query|contains:
            - 'iframe'
            - 'src'
        cs-uri-query|contains:
            - 'vimeo.com'  # legitimate, used as baseline
        cs-uri-query|re:
            - 'vimeo\.[a-z]+/.*[<>"\x27]'
    condition: selection_body and (selection_payload or selection_vimeo_bypass)
    falsepositives:
        - Legitimate code blocks in forum posts that document HTML/CSS
        - Users pasting iframe embed code into posts without executing it
level: medium

YARA Rule

/*
   YARA rule for hunting logs, captured HTTP traffic, or queued email
   artifacts containing CVE-2026-72720 injection patterns.
*/
rule discourse_prettytext_html_injection_cve_2026_72720
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects attribute values with markup that target the Discourse PrettyText.format_for_email reparse flaw."
        cve = "CVE-2026-72720"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72720"
        date = "2026-02-01"
        score = 60

    strings:
        $slug_attr = "data-slug=" ascii wide nocase
        $iframe_attr = "<iframe" ascii wide nocase
        $src_attr = "src=" ascii wide nocase
        $markup_open = /data-slug=[^ >]*</ ascii
        $html_tag = /<[a-zA-Z][a-zA-Z0-9]*[\s>]/ ascii
        $script_tag = "<script" ascii wide nocase
        $event_handler = "onerror" ascii wide nocase
        $encoded_lf = "%3C" ascii wide nocase

    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or filesize < 50MB
        and ($slug_attr or $iframe_attr)
        and ($markup_open or ($src_attr and $html_tag) or $script_tag or $event_handler or $encoded_lf)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-72720 Discourse PrettyText HTML injection attempt - data-slug with markup"; flow:established,to_server; content:"POST"; http_method; content:"data-slug"; http.client_body; nocase; content:"<"; http.client_body; pcre:"/data-slug=[^&>]*</i"; reference:cve,2026-72720; classtype:web-application-attack; sid:2026727201; rev:1;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-72720 Discourse Vimeo iframe allowlist bypass / HTML injection"; flow:established,to_server; content:"<iframe"; http.client_body; nocase; content:"src="; http.client_body; nocase; pcre:"/<iframe[^>]*src=[\"'](?!https?:\/\/[^\/]*vimeo\.com[\/\"'])[^\"']*[\"'][^>]*>/i"; reference:cve,2026-72720; classtype:web-application-attack; sid:2026727202; rev:1;)

Elastic Detection

// EQL query for Elastic Security / Elasticsearch web logs
// Detects POST requests whose body contains markup inside Discourse attribute values
where event.category == "web" and http.request.method == "POST"
  and (
    // hashtag data-slug value containing markup
    (wildcard(http.request.body.content, "*data-slug*<*") and
     wildcard(http.request.body.content, "*</*"))
    or
    // iframe with src attribute and HTML tag inside or near the attribute value
    (wildcard(http.request.body.content, "*<iframe*") and
     wildcard(http.request.body.content, "*src=*") and
     (wildcard(http.request.body.content, "*%3C*") or wildcard(http.request.body.content, "*<script*")))
  )
  and not wildcard(http.request.body.content, "*vimeo.com*")

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=pan:traffic OR sourcetype=iis
| where method="POST"
| search "data-slug" OR "<iframe" OR "src="
| rex field=uri "data-slug=(?<slug_value>[^&\s]+)"
| eval suspicious_html = if(match(slug_value, "(?i)<[a-z][a-z0-9]*\s|%3C"), 1, 0)
| eval vimeo_bypass = if(match(uri, "(?i)<iframe.*src=\"(?!https?://(www\.)?vimeo\.com)"), 1, 0)
| where suspicious_html=1 OR vimeo_bypass=1
| stats count by src_ip, uri, suspicious_html, vimeo_bypass, _time
| sort - count

// Optional: mail gateway visibility - scan for Discourse notification emails
// containing suspicious attributes
index=email sourcetype=barracuda OR sourcetype=mailgate
| search "data-slug" OR "<iframe"
| rex field=subject "Discourse"
| eval injection = if(match(_raw, "data-slug=\\\"[^\\\"]*\\\">"), 1, 0)
| stats count by src_ip, recipient, injection

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="100320" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.discourse\.|/posts|/topics</field>
    <regex>data-slug=.*[&lt;]/?[a-zA-Z]</regex>
    <description>CVE-2026-72720 - Discourse PrettyText HTML injection attempt (data-slug with markup)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>discourse,cve-2026-72720,html-injection,</group>
  </rule>

  <rule id="100321" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">\.discourse\.|/posts|/topics</field>
    <regex>&lt;iframe[^&gt;]*src=</regex>
    <description>CVE-2026-72720 - Discourse iframe embed with Vimeo allowlist bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>discourse,cve-2026-72720,html-injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: The fix is claimed by a single source (OSV) with a confidence rating of 2/4 — it is not independently confirmed. Administrators should treat the patch as provisional until the official Discourse advisory or changelog confirms the fix.

1. Immediate mitigations

   • Upgrade to a fixed release as soon as technically feasible: 2026.1.7, 2026.6.2, 2026.7.1, or 2026.8.0-latest.1 (select the branch matching your current deployment).
   • If an immediate upgrade is not possible, restrict or disable the ability of low-privileged users to embed iframes and uploads until patching is complete. Where the platform supports it, temporarily enforce plain-text notification emails for all users to nullify the HTML injection sink.
   • Review and, if feasible, disable automatic email generation for high-velocity notification types (e.g., replies and mentions) until the patch is applied.
   • Monitor forum logs for posts containing data-slug, iframe, or upload attributes with encoded markup (%3C, <) and quarantine such content.

2. Patch/upgrade steps

   • Verify the current version: docker exec discourse_web bundle exec rake version run in a test environment before the production upgrade (administrators should consult their own runbook).
   • Back up the Discourse database and uploads directory.
   • Upgrade to the nearest fixed version for your release line, following the official Discourse upgrade procedures.
   • After upgrade, verify the fix by generating a test notification email from a post containing each of the three trigger vectors (iframe src, secure-upload dimensions, hashtag data-slug) and confirming the attribute text is no longer reparsed as markup.
   • Independently confirm the patch by reviewing the Discourse GitHub release notes/security advisory for the listed version numbers.

3. Long-term hardening

   • Maintain a subscription to Discourse security advisories and monitor OSV/NVD for updates to this CVE (especially any change in patch confidence or the appearance of public PoCs).
   • Enforce least privilege for forum user roles; audit accounts that can create topics with embeds.
   • Apply Content Security Policy (CSP) headers on the Discourse web application to limit the impact of any future HTML injection on the web side.
   • Ensure mail gateways are configured to scan and sanitize HTML email, including rewriting of suspicious HTML tags and external resource references.
   • If this vulnerability class is a concern, evaluate a Web Application Firewall (WAF) rule set that blocks attribute values containing markup in POST bodies on Discourse paths.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72720
• OSV Advisory (patch source): https://osv.dev/vulnerability/CVE-2026-72720
• MITRE CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72720
• CWE-79 (XSS / HTML injection): https://cwe.mitre.org/data/definitions/79.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-72720 is not listed as of this report)

Threat actor activity: No known threat actor campaigns, exploit-in-the-wild evidence, or public weaponization of CVE-2026-72720 has been identified at the time of writing. The EPSS score (0.00299) and the absence of a CISA KEV listing suggest no active exploitation is currently observed.