Discourse EUVD-2026-55667

Exploitation requires an authenticated Discourse account with sufficient trust level to create posts that trigger Onebox resolution (Trust Level 0 or above by default, though site administrators may restrict this to higher trust levels). The Onebox feature must be active - this is the default state for Discourse installations. The Onebox origin allowlist must contain at least one entry; sites with an empty allowlist have no prefixes susceptible to the boundary bypass. Exploitation is strictly limited to authenticated users - unauthenticated visitors cannot post content and therefore cannot reach this path. The attack surface is scoped to the oEmbed iframe embedding flow within Onebox and does not affect general URL handling across Discourse. Sites that have disabled Onebox entirely or cleared the allowlist are not exploitable.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, score 6.3) categorizes this as medium severity: network-reachable, low complexity, requiring only an authenticated account, with no user interaction and unchanged scope. No EPSS data was supplied, so exploitation probability cannot be quantified. The vulnerability is absent from the CISA KEV catalog, and no public exploit code has been identified at time of analysis. The real-world exploitability is meaningfully constrained - an attacker must hold a valid authenticated account and the target site's Onebox allowlist must contain at least one entry. These conditions rule out unauthenticated mass scanning and limit opportunistic exploitation. The practical harm is content injection: malicious iframes embedded in posts visible to all subsequent readers, enabling phishing, social engineering, or drive-by malware delivery against forum visitors. The S:U (unchanged scope) metric bounds impact to the Discourse instance itself. The A:L metric in the provided CVSS vector is difficult to substantiate directly from the commit evidence, which describes content injection rather than service disruption - this metric may be conservative. Overall, the vulnerability is a realistic medium-priority issue for any Discourse operator, with remediation requiring only a routine version upgrade.

An authenticated Discourse user submits a post containing a crafted URL such as https://www.youtube.com.attacker.example/payload, where youtube.com is an entry in the site's Onebox allowlist. Onebox fetches the attacker-controlled page, which returns an oEmbed JSON response embedding an iframe pointing to the malicious origin; the iframe source passes the broken allowlist regex because the prefix https://youtube.com matches without a boundary check. The malicious iframe is then rendered inline in the post, exposing all subsequent visitors to attacker-controlled content such as phishing pages or drive-by malware. No public proof-of-concept exploit has been identified, but the upstream commit diff and regression test cases in the advisory provide sufficient implementation detail to reproduce the bypass independently.