CVE-2026-72721

Findings: CVE-2026-72721 affects Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The root cause is a case-sensitive comparison in Onebox::DomainChecker.is_blocked?, which compares hostnames and SiteSetting.blocked_onebox_domains entries. This allows an attacker to bypass c...