What is the CVSS score of CVE-2026-72721?

CVE-2026-72721 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-72721?

Yes, a patch is available for CVE-2026-72721. Update the affected software to the latest version immediately.

Discourse CVE-2026-72721

EUVD-2026-55657 MEDIUM

Improper Handling of Case Sensitivity (CWE-178)

2026-08-10 GitHub_M

Information Disclosure Discourse

5.3

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Register or use existing forum account
Delivery

Post URL containing redirect to blocked domain with mixed-case hostname
Exploit

Discourse Onebox fetches URL and follows redirect
Execution

Case-sensitive `is_blocked?` check fails to match blocklist entry
Impact

Onebox renders preview exposing blocked domain content to forum readers

Vulnerability Assessment

Weakness	CWE CWE-178 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Case sensitivity handling
Exploitation Conditions	Exploitation requires an active registered account on the target Discourse instance with standard post-creation permissions - anonymous posting does not typically apply. The critical prerequisite is that the administrator must have populated `SiteSetting.blocked_onebox_domains` with at least one domain entry; instances with an empty blocklist have no restriction to bypass. The attacker must be able to craft or use a redirect chain that terminates at a blocked domain with non-lowercase hostname casing. Exploitation is limited to the Onebox preview rendering path and does not affect other access controls or authentication mechanisms. The CVSS vector PR:N may overstate exposure - the realistic limiting factor is that posting URLs requires account registration on most Discourse instances.
Impact	The official CVSS 3.1 score of 5.3 Medium uses AV:N/AC:L/PR:N/UI:N, but the PR:N rating warrants scrutiny: standard Discourse deployments require user registration to post content, meaning exploitation in practice likely requires an authenticated account (PR:L), which would lower the score to approximately 4.3. EPSS data was not provided in the available intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. The impact is constrained to Low confidentiality - an attacker can obtain Onebox-rendered previews of blocked domains, but cannot escalate privileges, execute code, or access data beyond what the Onebox fetcher retrieves. Real-world risk is further bounded by requiring a non-empty `blocked_onebox_domains` blocklist to be configured; instances without domain restrictions are unaffected. This is a low-severity policy-bypass rather than a high-severity exploitation primitive, and the absence of known active exploitation or POC code keeps the operational priority low.
Exploit ScenarioDerived	A registered Discourse user constructs a URL pointing to a redirect service that forwards to a blocked domain with mixed-case hostname characters (e.g., a redirect to `hTTps://Blocked-Example.COM/sensitive-content`). When the user posts this link, Discourse's Onebox subsystem follows the redirect, invokes `DomainChecker.is_blocked?`, which fails to match `Blocked-Example.COM` against the lowercase `blocked-example.com` blocklist entry, and renders a full link preview exposing the restricted content to all forum readers.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 10, 2026

Onebox domain blocklist bypass in Discourse allows forum users to circumvent administrator-configured content restrictions by exploiting case-sensitive hostname comparison in Onebox::DomainChecker.is_blocked?. Versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are affected across all maintained release branches. An attacker with a forum account can post a link whose redirect target hostname uses mixed casing (e.g., BLOCKED-Domain.Com) to evade blocklist enforcement and cause Discourse to render a rich link preview of content the administrator intended to restrict. No public exploit has been identified and the vulnerability is absent from CISA KEV.

RemediationAI

Upgrade to the patched release corresponding to your installed branch: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0. Vendor-released patches are available via GitHub pull requests #42091-#42094 and commits a3e10759fef, c2eb6b0e559, caa615c371b, and f503971d311 in the official Discourse repository. The security advisory is at https://github.com/discourse/discourse/security/advisories/GHSA-3x7x-24rq-h5j6. If immediate patching is not possible, administrators can disable the Onebox feature entirely via enable_onebox: false in site settings, which eliminates link preview rendering but removes all rich preview functionality as a trade-off. A weaker partial mitigation is to ensure all entries in SiteSetting.blocked_onebox_domains are lowercase, which reduces but does not eliminate the bypass surface since redirect chains may still introduce unexpected casing.

Affected VersionsENISA

discourse < 2026.1.6

discourse 2026.7.0-latest, < 2026.7.0

discourse 2026.6.0-latest, < 2026.6.1

discourse 2026.5.0-latest, < 2026.5.2

Affected Packages

euvd discourse fix: 2026.1.6

euvd discourse_2026_5_0_latest fix: 2026.5.2

euvd discourse_2026_6_0_latest fix: 2026.6.1

euvd discourse_2026_7_0_latest fix: 2026.7.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Discourse is a Ruby on Rails open-source discussion platform featuring Onebox, a subsystem that fetches and renders rich link previews for posted URLs. The vulnerable method, Onebox::DomainChecker.is_blocked?, compares redirect target hostnames against the administrator-configured SiteSetting.blocked_onebox_domains allowlist using case-sensitive Ruby string comparison. CWE-178 (Improper Handling of Case Sensitivity) is the root cause class: DNS resolution is case-insensitive per RFC 4343, meaning BLOCKED-DOMAIN.COM and blocked-domain.com resolve to identical hosts, but Ruby's default string equality (==) treats them as distinct. The affected CPE is cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*, covering the full Discourse product across all tracked branches prior to the patched releases.

Know when Discourse gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI 4.3 MEDIUM

Posting links on Discourse requires a registered account in standard deployments, making PR:L more accurate than the official PR:N; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing character casing in a redirect target hostname. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Threat Intelligence Overview

EPSS Score

0.4%

Top 65% exploitable

Prevalence

Medium

widely-used open-source forum platform across tech and enterprise communities

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.