UpHeron
All vulnerabilities

Servers and applications

CVE-2026-27166

Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue has been fixed in versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2. To workaround this issue, remove Codepen from the list of allowed…

Severity
Medium 5.4
Published
19 Mar 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
2026.1.2, 2026.2.1, 2026.3.0
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Every version before 2026.3.0
  • From 2026.1.0 before 2026.1.2
  • From 2026.2.0 before 2026.2.1
  • Version 2026.3.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-27166
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-27166