# CVE-2026-91132: Discourse wildcard iframe origin allowlist bypass

Source: https://junglewise.ai/threats/cve-2026-91132-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91132 · Severity: medium · CVSS 4.3 · Published 2026-09-24

Discourse, an open-source discussion platform, contains a flaw in how it validates iframe URLs when wildcard patterns are configured in the allowed_iframes setting. An attacker who can create posts or trigger oEmbed requests could craft a malicious iframe URL that bypasses the domain allowlist check, causing untrusted content to be embedded in the platform. This could lead to unauthorized content embedding and potential security policy violations on affected sites.

Technologies: [Discourse](https://junglewise.ai/threats/technologies/discourse). Vendors: [Discourse](https://junglewise.ai/threats/vendors/discourse).

## Quick answers

**Is CVE-2026-91132 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91132 being exploited in the wild.

**How severe is CVE-2026-91132?** Medium severity, with a CVSS score of 4.3, published 24 September 2026.

**Which products and versions are affected?** Discourse before 2026.1.8, before 2026.6.3, before 2026.7.2, before 2026.8.0.

**Is there a fix for CVE-2026-91132?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-91132 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-91132?** Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the wildcard iframe origin validation logic, where the check matches against allowed domain text but does not properly respect URL authority boundaries (the separator between scheme/authority and path). An attacker can craft a URL with a trusted suffix appearing after the authority separator, causing browser URL parsing to select an attacker-controlled origin while the allowlist validation passes. Exploitation requires posting privileges and a site-configured wildcard iframe pattern; it affects versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

## Affected products

- Discourse Discourse before 2026.1.8, before 2026.6.3, before 2026.7.2, before 2026.8.0

## Timeline

- 2026-09-24: disclosed

## References

- [https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5](https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5)
- [https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a](https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a)

## Related threats

- [Discourse reflected cross-site scripting in email unsubscribe](https://junglewise.ai/threats/cve-2017-20290-discourse-1-9-0-beta2-before-1-9-0-beta13-contains-a-reflected)
- [Discourse oEmbed HTML injection in iframe allowlist](https://junglewise.ai/threats/cve-2026-91159-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse insufficient upload security metadata reconciliation](https://junglewise.ai/threats/cve-2026-91157-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse HTML injection in chat message excerpts](https://junglewise.ai/threats/cve-2026-91121-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)
- [Discourse HTML injection in lazy video embed notifications](https://junglewise.ai/threats/cve-2026-91120-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)