Discourse Onebox Domain Checker Case-Sensitivity Bypass (v2026.7.0)
CVE-2026-72721 Published on August 10, 2026
Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing character casing in a redirect target hostname. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Vulnerability Analysis
CVE-2026-72721 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
Improper Handling of Case Sensitivity
The software does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
Products Associated with CVE-2026-72721
Want to know whenever a new CVE is published for Discourse? stack.watch will email you.
Affected Versions
discourse:- Version < 2026.1.6 is affected.
- Version >= 2026.5.0-latest, < 2026.5.2 is affected.
- Version >= 2026.6.0-latest, < 2026.6.1 is affected.
- Version >= 2026.7.0-latest, < 2026.7.0 is affected.