Discourse CVE-2026-91120

Requires: (1) an authenticated Discourse account with standard posting privileges; (2) 'lazy video embeds' enabled, which is the DEFAULT configuration; (3) an enabled video provider (YouTube, Vimeo, or TikTok) and the attacker's ability to control that provider-side video title with embedded markup; and (4) a recipient who reads the resulting notification email or chat summary in an HTML-capable email client. Exploitation is limited by the fact that the impact is confined to the email/chat-summary rendering context - it does NOT reach a Discourse browser session or the forum page - and by email clients that strip scripting/event handlers, which blunts any active payload to passive content injection.

This is a genuine but low-priority issue. The CVSS 3.1 base score is 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - network reachable, low complexity, but requiring low-privilege authentication (PR:L, a standard posting account). No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The most important tempering signal comes from the description itself: the injected markup lands only in a recipient's HTML-capable email client or chat summary and explicitly does NOT expose a Discourse browser session or affect the forum page. Modern email clients aggressively strip scripting and event handlers, so the practical impact is closer to HTML/content injection (spoofed content, phishing-style formatting) than executable code. Note also a discrepancy: NVD marks UI:N, yet realistic exploitation requires the victim to open the notification email, which argues for UI:R and a slightly lower real-world score - verify with vendor. Overall this is a low-real-risk hardening fix, not an urgent patch.

An authenticated user with standard posting privileges publishes a post embedding a video from an enabled provider (YouTube, Vimeo, or TikTok) whose provider-side title contains HTML markup such as an event-handler attribute. When Discourse generates a notification email or chat summary referencing that post, the malicious title is placed into the output as HTML rather than escaped text, so recipients reading the message in an HTML-capable email client may see injected content. No public exploit code is identified at time of analysis.