CVE-2026-72721 json
Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison
published 3mo ago modified 2mo ago also BIT-discourse-2026-72721 , EUVD-2026-55657 , GHSA-3x7x-24rq-h5j6
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing character casing in a redirect target hostname. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Patch / fix
- bitnami discourse 2026.1.6, 2026.5.2, 2026.6.1
- discourse discourse 2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0
- github.com/discourse/discourse@a3e1075 commit
- github.com/discourse/discourse@c2eb6b0 commit
- github.com/discourse/discourse@caa615c commit
- github.com/discourse/discourse@f503971 commit
- github.com/discourse/discourse#42091 pull request
- github.com/discourse/discourse#42092 pull request
- github.com/discourse/discourse#42093 pull request
- github.com/discourse/discourse#42094 pull request
Is CVE-2026-72721 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3mo ago
Exploit prediction
0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | <2026.1.6 >=2026.5.0, <2026.5.2 >=2026.6.0, <2026.6.1 |
2026.1.6 2026.5.2 2026.6.1 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-178 Improper Handling of Case Sensitivity
References
-
github.com
/discourse/discourse/pull/42091
web
-
github.com
/discourse/discourse/pull/42092
web
-
github.com
/discourse/discourse/pull/42093
web
-
github.com
/discourse/discourse/pull/42094
web
-
github.com
/discourse/discourse/commit/a3e10759fef47f03d450649bb51d9e84f4c68b8f
web
-
github.com
/discourse/discourse/commit/c2eb6b0e5597d6f28f4be739b83300bc9c69e3cd
web
-
github.com
/discourse/discourse/commit/caa615c371b1696982ee11ac8f3558f0f8ced584
web
-
github.com
/discourse/discourse/commit/f503971d311b7b0dfdb751ee8cfd67e8cb99f5c5
web
-
github.com
/discourse/discourse/security/advisories/GHSA-3x7x-24rq-h5j6
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-72721
web
Sources
- CVE List CVE-2026-72721
- NVD CVE-2026-72721
- OSV BIT-discourse-2026-72721
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.