Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing character casing in a redirect target hostname. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-10T16:19:49.360Z",
  "pubdate": "2026-08-10T16:19:49.360Z",
  "executiveSummary": "A casing-based domain restriction bypass vulnerability exists in the Discourse discussion platform prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The vulnerability resides in the Onebox::DomainChecker.is_blocked? function, which enforces security checks on target hostnames against the SiteSetting.blocked_onebox_domains configuration.\nThe core impact of this vulnerability is the circumvention of established domain blacklists, allowing malicious users to integrate restricted or untrusted resources into Discourse posts via Onebox previews. This exposes users to potential phishing, unauthorized data exfiltration, or interactions with malicious external endpoints despite administrative controls intended to block them.\nThe vulnerability affects all Discourse deployments running vulnerable versions prior to the designated patch releases. An attacker with standard capabilities to create or edit posts containing URLs can exploit this flaw by manipulating the character casing of the targeted hostname. No elevated privileges or prior authentication beyond standard post creation capabilities are explicitly required if the platform permits user-generated links.\nMitigation requires upgrading the Discourse platform to the patched versions 2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0, or later, where case-insensitive hostname comparison is properly enforced.",
  "technicalDetails": "The vulnerability is caused by a string comparison flaw within the Onebox::DomainChecker.is_blocked? function in Discourse. Specifically, the underlying logic evaluates incoming target hostnames against the entries defined in SiteSetting.blocked_onebox_domains using a case-sensitive matching mechanism.\nBecause domain names in URLs are case-insensitive per standard internet specifications, but the validation check is strictly case-sensitive, a discrepancy arises. When an administrator populates SiteSetting.blocked_onebox_domains with a blocked domain string (for example, in lowercase), an attacker can supply a redirect target or Onebox resource URL containing uppercase or mixed-case characters for that same domain.\nThe step-by-step attack flow proceeds as follows: First, an administrator configures a blocklist of forbidden domains within SiteSetting.blocked_onebox_domains. Second, an attacker crafts a malicious post containing a URL or a redirect target pointing to a restricted domain, deliberately altering the character casing of the hostname (e.g., changing 'example.com' to 'ExAmPlE.cOm'). Third, when the Discourse Onebox parser processes the link, it invokes Onebox::DomainChecker.is_blocked? to verify whether the domain is permitted. Fourth, because the function performs a direct, case-sensitive comparison, the mixed-case hostname fails to match the lower-case entry in the blocked domains list. Fifth, the validation check incorrectly evaluates the hostname as permissible, allowing the Onebox preview to resolve, fetch, or render content from the restricted domain.\nThe vulnerable component is the Onebox::DomainChecker module, specifically the is_blocked? validation routine. Affected versions include all instances of Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The attack vector is network-based via standard application interactions, requiring the ability to submit URLs processed by the Onebox engine."
}