What is the CVSS score of EUVD-2026-55667?

EUVD-2026-55667 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-55667?

Yes, a patch is available for EUVD-2026-55667. Update the affected software to the latest version immediately.

Discourse EUVD-2026-55667

| CVE-2026-72728 MEDIUM

Improper Input Validation (CWE-20)

2026-08-10 GitHub_M

Authentication Bypass Discourse

6.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-reachable via authenticated users (PR:L, AV:N); content injection yields limited confidentiality and integrity impact; no availability impact is substantiated by the iframe injection mechanism described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 16:53 vuln.today

Analysis Generated

Aug 10, 2026 - 16:53 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

AnalysisAI

Onebox allowlist bypass in Discourse (all versions prior to 2026.1.7) enables authenticated forum users to embed malicious iframes and attacker-controlled content in posts by exploiting a regex prefix-matching flaw in the origins_to_regexes method. The core defect - missing URL boundary anchors and an overly permissive wildcard expansion - allows domains like youtube.com.attacker.example to pass validation as the allowlisted youtube.com. No public exploit has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; vendor-released patches exist as versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

Technical ContextAI

Discourse's Onebox feature resolves URLs in posts to rich previews and oEmbed iframes using a configurable origin allowlist. The vulnerability resides in lib/onebox/engine.rb within the origins_to_regexes method, which converts allowlisted origin strings into Ruby regular expressions. Two compounding flaws existed: (1) the wildcard character * was expanded to \S*, which matches any non-whitespace character including ? and # - permitting attackers to use query or fragment components to inject a matching domain suffix (e.g., attacker.example?.kaltura.com/); and (2) the resulting regex used only a prefix anchor (\A) with no URL boundary requirement, so an allowlisted origin https://youtube.com positively matched https://youtube.com.attacker.example. The fix changes the wildcard expansion to [^/?#]* (restricting to a single URL authority segment) and appends a boundary group (?::\d+(?:[/?#]|\z)|[/?#]|\z) to host-only origins. CWE-20 (Improper Input Validation) is the root cause class - oEmbed iframe source URLs were matched against the allowlist without enforcing URL structural boundaries, allowing a class of URL authority confusion attacks.

RemediationAI

Upgrade Discourse to version 2026.1.7, 2026.6.2, 2026.7.1, or 2026.8.0-latest.1 as confirmed by the GitHub Security Advisory (https://github.com/discourse/discourse/security/advisories/GHSA-qp9j-3v7r-wrvr) and the upstream fix commit (https://github.com/discourse/discourse/commit/92eec47e8b477cb8b4ccdb237e26dc1ba8f8b76b). For sites unable to upgrade immediately, removing all entries from the Onebox origin allowlist eliminates the bypass surface entirely, though it also disables all legitimate iframe embeds (YouTube, Vimeo, etc.) - operators should weigh this functionality trade-off carefully. A narrower compensating control is to restrict post creation or Onebox triggering to higher trust levels, reducing the pool of users who can submit URLs for resolution; this preserves embed functionality for trusted users while limiting exposure from lower-trust accounts.