Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-72728

Discourse: Onebox iframe origin allowlist enforces URL authority boundary

Medium6.3EPSS 0.31%
Published
Updated
Reserved
Assigned by
GitHub_M

Description

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

Scores

CVSS scores of CVE-2026-72728, by who scored it
Scored byCVSSScoreVector
GitHub_MCNA (assigner)3.1Medium6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVDNVD · Deferred3.1Medium6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS (exploitation in 30 days)
0.31% · top 76% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

Affected products

  • discourse · discourse

    • affected < 2026.1.7
    • affected >= 2026.6.0-latest, < 2026.6.2
    • affected >= 2026.7.0-latest, < 2026.7.1
    • affected >= 2026.8.0-latest, < 2026.8.0-latest.1

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-72728 badge
[![CVE-2026-72728](https://trackcve.app/badge/CVE-2026-72728.svg)](https://trackcve.app/cve/CVE-2026-72728)

Record last updated .