Discourse EUVD-2026-55656

Exploitation requires an authenticated Discourse account with sufficient trust level to create posts containing Vimeo iframes, hashtags referencing categories, or content involving secure-upload references - typically trust level 1 or higher, which is granted to users after minimal site engagement and is configurable per site. The injection materializes exclusively in the email formatting code path, so at least one other user must have email notifications or digest emails enabled for the targeted topic or thread. Three specific Discourse features must be active for each respective vector: Vimeo oneboxing (enabled by default when a Vimeo URL is embedded in a post), the secure media uploads feature (requires explicit administrator enablement in site settings), and hashtag rendering (enabled by default for category and tag references). Exploitation is bounded by the authenticated requirement - unauthenticated visitors cannot trigger the flaw - and by the need for a victim to receive and render an HTML email generated from the crafted content. Non-default deployments that disable email entirely or enforce invite-only membership with verified identities present substantially reduced exposure.

The CVSS 3.1 base score of 6.4 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N accurately reflects the real-world risk profile: network-reachable, low complexity, requiring only a low-privilege authenticated account, with a scope change to email clients outside the Discourse application boundary. No EPSS data is present in the provided intelligence, and the CVE is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis; no public POC was identified, consistent with disclosure coordinated through GitHub's private advisory process. The three-vector attack surface - Vimeo embeds, hashtag slugs, and secure-upload notices - means that even a mid-sized municipal IT team in malbork running an open-registration Discourse community would be exposed to any authenticated member crafting malicious content. The scope change is the most consequential signal: injected HTML in email notifications bypasses Discourse's in-application CSP entirely and executes inside recipients' email clients, which frequently offer weaker or no sandboxing. Risk is highest for publicly registered communities with many members and active email digests; risk is substantially reduced for invite-only or SSO-gated deployments where the authenticated attacker pool is tightly controlled.

An authenticated Discourse community member crafts a post containing a Vimeo embed with a maliciously constructed src URL - targeting a non-Vimeo host that previously passed the insufficient origin allowlist - embedding injected HTML tags within the URL or dimension parameters. When a subscribed user receives an email notification for that topic, Discourse's format_for_email conversion re-parses the attribute value as raw markup and delivers the injected HTML to the recipient's email client. No public exploit code has been identified, but the straightforward string-injection nature of all three vectors makes independent construction of proof-of-concept payloads feasible for a moderately skilled attacker.