CVE-2026-91132

Executive Summary

CVE-2026-91132 is a URL validation bypass vulnerability in Discourse, an open-source discussion platform, affecting sites that use wildcard patterns in the allowed_iframes setting. Prior to versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the wildcard origin check could be tricked into matching an allowlisted domain suffix that appears after a URL authority separator, while the browser parses a different, attacker-controlled origin. A user with posting privileges can exploit this via a crafted post or a Onebox oEmbed response, causing an attacker-controlled iframe to render. The impact is limited to integrity (CVSS 4.3), with no confidentiality or availability impact, and the attack requires the site to be configured with a wildcard iframe pattern.

Technical Analysis

The vulnerability is classified as CWE-346: Origin Validation Error. At its core, the flaw is a parser differential between how Discourse validates an iframe URL and how the browser resolves its origin.

Discourse's allowed_iframes setting supports wildcard patterns to permit iframes from a set of domains. The validation logic performs a suffix/text match against the allowlisted domain. However, when the crafted URL contains an authority separator (such as a userinfo delimiter or another URL component boundary) before the allowlisted domain text, the allowlist check still sees the trusted domain string and passes. The browser, applying its own URL parsing rules, resolves the origin to the attacker-controlled portion of the URL rather than the allowlisted domain.

This is a classic "allowlist check on raw string vs. browser URL parsing" mismatch. The check operates on the textual representation, while the browser's origin determination follows the WHATWG URL parsing algorithm, which selects a different authority. Because the two parsers disagree on which component is the origin, an iframe that appears allowlisted is rendered from an attacker-controlled origin.

The attack surface is any Discourse deployment that (1) has wildcard patterns configured in allowed_iframes, and (2) allows users with posting privileges to embed iframes or trigger Onebox oEmbed expansion for attacker-controlled URLs. The flaw is reachable through post content and through Onebox oEmbed responses, meaning the injected iframe can be rendered without direct HTML editing by the attacker in the oEmbed path.

No code-level function names, file paths, or API parameters beyond allowed_iframes and the Onebox/oEmbed mechanism are disclosed in the available description. Additional implementation details are not available; the analysis below remains at the vulnerability-class level.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (origin validation error / parser differential).

1. Reconnaissance / Target Identification. The attacker identifies a Discourse instance running a version prior to 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 that uses wildcard patterns in the allowed_iframes setting. Public Discourse instances are identifiable via fingerprinting (e.g., Shodan dorks for the Discourse product/title/html). The attacker must also hold an account with posting privileges, or be able to induce a Onebox oEmbed request to an attacker-controlled URL.

2. Triggering the Flaw. The attacker crafts an iframe URL in which the allowlisted domain suffix appears after a URL authority separator. Discourse's wildcard origin check matches the allowlisted domain text and accepts the URL, while the browser's URL parser resolves a different attacker-controlled origin. The crafted URL is submitted either as a post or via a Onebox oEmbed response.

3. Payload / Execution. Because the validation mismatch allows the URL through, the attacker-controlled iframe is rendered. The iframe loads content from the attacker-controlled origin, executing in the context of the victim's browser within the Discourse page. The specific payload is delivered from the attacker's origin and is not constrained by the allowlist.

4. Post-Exploitation Impact. The rendered iframe can present attacker-controlled content to viewers, enabling content spoofing, phishing, or UI redressing against users who view the post. The CVSS vector (C:N/I:L/A:N) indicates the primary impact is to integrity — unauthorized modification/insertion of rendered content — with no direct confidentiality or availability effect and no change in scope.

Impact Assessment

The business impact is moderate and primarily reputational and integrity-related. An attacker who can render an arbitrary iframe on a trusted Discourse community page can conduct content spoofing, phishing, or social-engineering attacks against that community's users, leveraging the platform's trusted origin.

Affected systems: any Discourse deployment with wildcard allowed_iframes patterns that has not upgraded to 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0. The blast radius is limited to users who view the affected post or the oEmbed-rendered content.

CVSS subscores (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N):

• Attack Vector: Network (AV:N) — exploitable remotely.
• Attack Complexity: Low (AC:L) — no special conditions beyond the configuration and posting requirement.
• Privileges Required: Low (PR:L) — the attacker needs posting privileges or the ability to trigger an oEmbed request.
• User Interaction: None (UI:N) — no victim interaction beyond viewing rendered content is required per the vector.
• Scope: Unchanged (S:U).
• Confidentiality: None (C:N); Integrity: Low (I:L); Availability: None (A:N).

No CISA KEV listing and no known in-the-wild exploitation have been reported. EPSS has not yet been scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Discourse allowed_iframes Wildcard Bypass Attempt
id: 8f2c1a4e-3b7d-4c9e-9a1f-0d5e6b7c8a90
status: experimental
description: Detects requests or posts containing iframe URLs crafted with an allowlisted domain suffix placed after a URL authority separator, targeting Discourse allowed_iframes wildcard validation (CVE-2026-91132).
logsource:
  product: discourse
  service: application
detection:
  selection_iframe:
    message|contains:
      - '<iframe'
  selection_separator:
    message|contains:
      - '@'
      - '\\\\'
  selection_allowed_domain:
    message|contains:
      - 'allowed_iframes'
  condition: selection_iframe and selection_allowed_domain
  # Tune selection_separator and the domain list to the site's actual allowed_iframes patterns.
fields:
  - user_id
  - ip
  - url
falsepositives:
  - Legitimate embedded iframes that contain userinfo or path characters in their URLs.
level: medium
tags:
  - attack.t1190
  - cve.2026.91132

YARA Rule

rule CVE_2026_91132_Discourse_Iframe_Origin_Bypass
{
    meta:
        description = "Detects crafted iframe URLs attempting to bypass Discourse allowed_iframes wildcard validation (CVE-2026-91132)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "CVE-2026-91132"
        severity = "medium"

    strings:
        $iframe = "<iframe" ascii nocase wide
        $allowed = "allowed_iframes" ascii nocase
        $sep1 = "@" ascii
        $sep2 = "//" ascii

    condition:
        $iframe and any of ($sep*) and filesize < 200KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91132 Discourse allowed_iframes wildcard origin bypass attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"<iframe"; nocase; http.request_body; content:"@"; distance:0; reference:cve,2026-91132; reference:url,valtersit.com; classtype:attempted-user; sid:202691132; rev:1;)

Elastic Detection

sequence by user.id with maxspan=5m
  [any where process.name == "discourse" and message contains "<iframe" and message contains "@"]
  [any where process.name == "discourse" and message contains "allowed_iframes"]

Splunk SPL Query

index=discourse sourcetype=discourse:application
| search ("<iframe" AND ("@" OR "\\"))
| search "allowed_iframes" OR "onebox" OR "oembed"
| rex field=_raw "(?<iframe_src>src\s*=\s*[\"'](?<url>[^\"']+)[\"'])"
| table _time, host, user, url, iframe_src
| sort - _time

Wazuh OSSEC Rule

<group name="discourse,cve_2026_91132,">
  <rule id="202691132" level="7">
    <decoded_as>json</decoded_as>
    <field name="message">\.*iframe\.*</field>
    <match>allowed_iframes|onebox|oembed</match>
    <description>CVE-2026-91132: Possible Discourse allowed_iframes wildcard origin bypass attempt (crafted iframe URL)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations.

   • Remove or tighten wildcard patterns in the allowed_iframes setting. Replace broad wildcards with explicit, fully qualified origins where operationally feasible.
   • Restrict posting privileges to trusted users until the instance can be upgraded.
   • Disable or limit Onebox/oEmbed expansion for untrusted URLs if the site does not require it, to close the oEmbed rendering path.
   • Increase moderation review of posts containing iframes.

2. Patch / Upgrade Steps.

   • Upgrade Discourse to version 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 (whichever applies to the deployed release channel).
   • Verify the upgrade applied by confirming the running version and re-checking the allowed_iframes configuration behavior.
   • Note: no vendor patch confirmation or workaround has been registered in tracked sources at this time; verify advisory status directly with the Discourse project before and after upgrading.

3. Long-Term Hardening.

   • Adopt origin validation that relies on parsed URL components (scheme + host + port) rather than substring/suffix text matching, to avoid parser-differential bypasses.
   • Maintain a least-privilege posting model and review all users with iframe-embedding or HTML-capable privileges.
   • Monitor for advisories and apply security releases promptly; track CVE-2026-91132 status until vendor confirmation is available.
   • Log and alert on iframe URL patterns containing authority separators that also reference allowlisted domains.

References

• NVD — CVE-2026-91132: https://nvd.nist.gov/vuln/detail/CVE-2026-91132
• CWE-346 — Origin Validation Error: https://cwe.mitre.org/data/definitions/346.html
• Discourse project release/advisory information: https://www.discourse.org/ (consult the official Discourse security advisories and release notes for versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-91132 is not listed as of this report)
• FIRST EPSS: https://www.first.org/epss/ (CVE-2026-91132 not yet scored at time of writing)

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-91132 based on the data provided.