Medium severity6.3NVD Advisory· Published Aug 10, 2026· Updated Sep 8, 2026

CVE-2026-72728

Description

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Discourse (software)/Discoursellm-fuzzy
Range: <2026.1.7, 2026.6.2, 2026.7.1, 2026.8.0-latest.1
osv-coords
pkg:bitnami/discourse
Range: < 2026.1.7

Patches

Vulnerability mechanics

References

github.com/discourse/discourse/commit/92eec47e8b477cb8b4ccdb237e26dc1ba8f8b76bnvd
github.com/discourse/discourse/security/advisories/GHSA-qp9j-3v7r-wrvrnvd

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000