CVE-2026-72721

CVE-2026-72721 is a case-sensitivity bypass in Discourse's Onebox domain blocklist. The vulnerability lives in the `is_blocked?` method, which compares the incoming domain against `SiteSetting.blocked_onebox_domains` using Ruby's default case-sensitive string comparison. Domain names are case-insensitive by RFC 4343, so an admin blocking `malicious-site.com` will find that `Malicious-Site.COM` renders perfectly well through Onebox. This is not a sophisticated bug. It's the kind of string comparison developers write without thinking, because Ruby strings are case-sensitive by default. But the security consequence is real: organizations using the blocklist as a phishing-prevention or content-moderation control have a false negative — the system says 'allowed' when it should say 'blocked' — and there's no alert, no log entry, no indication anything is wrong. What makes this worse in practice: Onebox renders embedded content as a native-looking card inside the forum, with the domain displayed but visually subordinated to the preview. That's a higher-fidelity social engineering vector than a raw link. If your blocked-domains list is the only domain-level enforcement for embedded content, the bypass doesn't just let a URL through — it renders a trustworthy-looking card that appears vouched for by your forum. Check your `DomainChecker` module for any other domain-validation functions that might share this pattern. If you've extended Discourse with plugins or custom handlers that inherit or mirror this logic, the core patch won't reach them. The vulnerability doesn't disappear — it relocates. The CVSS 5.3 rates the technical exploitability correctly, but it doesn't account for deployments where this blocklist is a primary rather than secondary control. For those organizations, the actual blast radius is higher than the score suggests. Patch it, audit for similar patterns elsewhere in your Onebox pipeline, and treat any domain-matching code that doesn't explicitly normalize case as suspect.

Reviewed through automated stages and approved by a human before publication.