CVE-2026-91132Published
Discourse: Wildcard iframe origin allowlist bypass via authority separators
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-91132 · Microsoft / collected KEV context
cve-program · CVE-2026-91132
- https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp
- https://github.com/discourse/discourse/pull/42882
- https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5
- https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a
- https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9
- https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.