---
id: CVE-2026-91159
title: Discourse is an open-source discussion platform
summary: >-
  Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1,
  2026.7.3, and 2026.1.9, oEmbed processing treated an entire
  attacker-controlled HTML fragment as trusted when the fragment contained an
  iframe whose source mat…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N'
cwe:
  - CWE-79
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:17:56.737'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91159'
references:
  - url: >-
      https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/dde8bc4fb6200139f5eff7e100b0f3e829d37ab3
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/ed6f83f123d1a4c6c6c7e64c8a2233e3cb6a28d7
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/security/advisories/GHSA-f9jx-vv33-4282
    label: security-advisories@github.com
tags:
  - nvd
  - exploit-available
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/sl4x0/autheo-cve-2026-91159-poc'
  checkedAt: '2026-10-14T16:41:07.242Z'
exploitAvailable: true
ingestedAt: '2026-10-14T16:40:32.134Z'
---

## Overview

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.