VulnSocial

CVE-2026-27166General(discourse / discourse)

LOWCVSS 5.4 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue has been fixed in versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2. To workaround this issue, remove Codepen from the list of allowed iframes.

discourse CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-80

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • discourse

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • General: 2 classified signals
  • Disclosure: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-03-23)
  • 3 total mentions across 2 days

Affected systems

Vendors
discourse
Products
discourse

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-20: 1Mentions · 2026-03-23: 2Technical Details · 2026-03-20: 1Technical Details · 2026-03-23: 203-2003-23
Signal classification2 categories
General
266.7%
Disclosure
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-201
Disclosure1
2026-03-232
General2
Full discourse3 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-27166 Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed ifra… https://www.cve.org/CVERecord?id=CVE-2026-27166 ----- Traducción: CVE-2026-27166 Dis… http://infoflow.cloud`

    Post summary

    The text announces CVE-2026-27166, noting insufficient cleanup in a component of Discourse, but provides no PoC, exploit, patch or active exploitation details.

    0000023
    61 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-27166 Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed ifra… https://www.cve.org/CVERecord?id=CVE-2026-27166

    Post summary

    CVE-2026-27166 concerns an insufficient cleanup flaw in Discourse’s default Codepen affecting older releases. No PoC, exploit, active use, or patch details are provided.

    00000132
    56.8K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-27166 Discourse URL Manipulation Vulnerability in Versions Prior to 2026.3.0-latest.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27166

    Post summary

    CVE‑2026‑27166 is a newly disclosed URL manipulation flaw in Discourse versions prior to 2026.3.0‑latest.1.

    0000035
    4.0K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appdiscoursediscourse---
Appdiscoursediscourse2026.3.0--

Explore more

Back to dashboarddiscourse CVEsdiscourse vulnerabilities