CVEvulnerability

CVE-2026-27166

5.4 MEDIUM Published 2026-03-19 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-03-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-80

Description

Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue has been fixed in versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2. To workaround this issue, remove Codepen from the list of allowed iframes.

Affected configurations

• discourse discourse (< 2026.3.0) • discourse discourse (>= 2026.1.0 < 2026.1.2) • discourse discourse (>= 2026.2.0 < 2026.2.1) • discourse discourse 2026.3.0

Related

Weakness · CWE (1)

  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References