PT-2026-22150 · Discourse · Discourse
Davidtaylorhq
·
Published
2026-02-26
·
Updated
2026-03-03
·
CVE-2026-26077
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Discourse versions prior to 2025.12.2
Discourse versions prior to 2026.1.1
Discourse versions prior to 2026.2.0
Description
Discourse is an open source discussion platform. Several webhook endpoints—SendGrid, Mailjet, Mandrill, Postmark, SparkPost, and Mailpace—in the
WebhooksController did not require a valid authentication token when no token was configured. This allowed unauthenticated attackers to forge webhook payloads and increase user bounce scores, potentially disabling legitimate user emails. The Mailpace endpoint lacked token validation entirely.Recommendations
For Discourse versions prior to 2025.12.2, ensure that webhook authentication tokens are configured for all email provider integrations in site settings, such as
sendgrid verification key, mailjet webhook token, postmark webhook token, and sparkpost webhook token.
For Discourse versions prior to 2026.1.1, ensure that webhook authentication tokens are configured for all email provider integrations in site settings, such as sendgrid verification key, mailjet webhook token, postmark webhook token, and sparkpost webhook token.
For Discourse versions prior to 2026.2.0, ensure that webhook authentication tokens are configured for all email provider integrations in site settings, such as sendgrid verification key, mailjet webhook token, postmark webhook token, and sparkpost webhook token.Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Discourse