CVE-2026-26077

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26077", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-10T18:01:31.902Z", "datePublished": "2026-02-26T14:58:13.971Z", "dateUpdated": "2026-02-27T16:19:00.984Z"}, "containers": {"cna": {"title": "Discourse doesn't ensure webhooks require a token", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/discourse/discourse/security/advisories/GHSA-j67c-53j2-4hfw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-j67c-53j2-4hfw"}], "affected": [{"vendor": "discourse", "product": "discourse", "versions": [{"version": "< 2025.12.2", "status": "affected"}, {"version": ">= 2026.1.0-latest, < 2026.1.1", "status": "affected"}, {"version": ">= 2026.2.0-latest, < 2026.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T14:58:13.971Z"}, "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) in the `WebhooksController` accepted requests without a valid authentication token when no token was configured. This allowed unauthenticated attackers to forge webhook payloads and artificially inflate user bounce scores, potentially causing legitimate user emails to be disabled. The Mailpace endpoint had no token validation at all. Starting in versions 2025.12.2, 2026.1.1, and 2026.2.0, all webhook endpoints reject requests with a 406 response when no authentication token is configured. As a workaround, ensure that webhook authentication tokens are configured for all email provider integrations in site settings (e.g., `sendgrid_verification_key`, `mailjet_webhook_token`, `postmark_webhook_token`, `sparkpost_webhook_token`). There's no current workaround for mailpace before getting this fix."}], "source": {"advisory": "GHSA-j67c-53j2-4hfw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T16:18:52.128042Z", "id": "CVE-2026-26077", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T16:19:00.984Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26077", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T16:18:52.128042Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T16:18:56.769Z"}}], "cna": {"title": "Discourse doesn't ensure webhooks require a token", "source": {"advisory": "GHSA-j67c-53j2-4hfw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "discourse", "product": "discourse", "versions": [{"status": "affected", "version": "< 2025.12.2"}, {"status": "affected", "version": ">= 2026.1.0-latest, < 2026.1.1"}, {"status": "affected", "version": ">= 2026.2.0-latest, < 2026.2.0"}]}], "references": [{"url": "https://github.com/discourse/discourse/security/advisories/GHSA-j67c-53j2-4hfw", "name": "https://github.com/discourse/discourse/security/advisories/GHSA-j67c-53j2-4hfw", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) in the `WebhooksController` accepted requests without a valid authentication token when no token was configured. This allowed unauthenticated attackers to forge webhook payloads and artificially inflate user bounce scores, potentially causing legitimate user emails to be disabled. The Mailpace endpoint had no token validation at all. Starting in versions 2025.12.2, 2026.1.1, and 2026.2.0, all webhook endpoints reject requests with a 406 response when no authentication token is configured. As a workaround, ensure that webhook authentication tokens are configured for all email provider integrations in site settings (e.g., `sendgrid_verification_key`, `mailjet_webhook_token`, `postmark_webhook_token`, `sparkpost_webhook_token`). There's no current workaround for mailpace before getting this fix."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T14:58:13.971Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26077", "state": "PUBLISHED", "dateUpdated": "2026-02-27T16:19:00.984Z", "dateReserved": "2026-02-10T18:01:31.902Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T14:58:13.971Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "discourse", "vendor": "discourse", "versions": [{"status": "affected", "version": "< 2025.12.2"}, {"status": "affected", "version": ">= 2026.1.0-latest, < 2026.1.1"}, {"status": "affected", "version": ">= 2026.2.0-latest, < 2026.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*", "matchCriteriaId": "6DB837D7-28C8-4E0F-B55F-AAAA36F32035", "versionEndExcluding": "2025.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*", "matchCriteriaId": "1CAFCC9D-53D7-4017-85A5-EE6CA5A6A11C", "versionEndExcluding": "2026.1.1", "versionStartIncluding": "2026.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:2026.2.0:*:*:*:latest:*:*:*", "matchCriteriaId": "BB002FDC-BC71-4C46-8AAF-A34EC717E0E7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) in the `WebhooksController` accepted requests without a valid authentication token when no token was configured. This allowed unauthenticated attackers to forge webhook payloads and artificially inflate user bounce scores, potentially causing legitimate user emails to be disabled. The Mailpace endpoint had no token validation at all. Starting in versions 2025.12.2, 2026.1.1, and 2026.2.0, all webhook endpoints reject requests with a 406 response when no authentication token is configured. As a workaround, ensure that webhook authentication tokens are configured for all email provider integrations in site settings (e.g., `sendgrid_verification_key`, `mailjet_webhook_token`, `postmark_webhook_token`, `sparkpost_webhook_token`). There's no current workaround for mailpace before getting this fix."}, {"lang": "es", "value": "Discourse es una plataforma de discusi\u00f3n de c\u00f3digo abierto. Antes de las versiones 2025.12.2, 2026.1.1 y 2026.2.0, varios puntos finales de webhook (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) en el 'WebhooksController' aceptaban solicitudes sin un token de autenticaci\u00f3n v\u00e1lido cuando no se hab\u00eda configurado ning\u00fan token. Esto permit\u00eda a atacantes no autenticados falsificar cargas \u00fatiles de webhook e inflar artificialmente las puntuaciones de rebote de los usuarios, lo que podr\u00eda provocar la desactivaci\u00f3n de correos electr\u00f3nicos leg\u00edtimos de usuarios. El punto final de Mailpace no ten\u00eda ninguna validaci\u00f3n de token. A partir de las versiones 2025.12.2, 2026.1.1 y 2026.2.0, todos los puntos finales de webhook rechazan las solicitudes con una respuesta 406 cuando no hay un token de autenticaci\u00f3n configurado. Como soluci\u00f3n alternativa, aseg\u00farese de que los tokens de autenticaci\u00f3n de webhook est\u00e9n configurados para todas las integraciones de proveedores de correo electr\u00f3nico en la configuraci\u00f3n del sitio (p. ej., 'sendgrid_verification_key', 'mailjet_webhook_token', 'postmark_webhook_token', 'sparkpost_webhook_token'). No hay una soluci\u00f3n alternativa actual para Mailpace antes de obtener esta correcci\u00f3n."}], "id": "CVE-2026-26077", "lastModified": "2026-06-17T10:25:41.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26077", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T16:18:52.128042Z", "version": "2.0.3"}}]}, "published": "2026-02-26T15:17:36.653", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-j67c-53j2-4hfw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2025.12.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2026.1.0-latest,2026.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2026.2.0-latest,2026.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "discourse", "source": "cna", "vendor": "discourse"}, "product": "discourse", "vendor": "discourse"}], "analysis": {"en": {"generated_at": "2026-04-17T14:21:44.550323+00:00", "value": {"mitigation_remediation": ["Upgrade Discourse to at least version 2025.12.2, 2026.1.1, or 2026.2.0, which implements token validation for all webhook endpoints.", "Configure a unique authentication token for each email provider integration in the site settings (e.g., sendgrid_verification_key, mailjet_webhook_token, postmark_webhook_token, sparkpost_webhook_token).", "For Mailpace integration, temporarily disable or remove the webhook endpoint until a patch becomes available, as no workaround exists for this provider."], "summary": {"action": "Patch Upgrade", "impact": "Unauthenticated Webhook Injection leading to email bounce tampering"}, "threat_synthesis": {"affected_systems": "The vulnerability affects installations of the open\u2011source discussion platform Discourse. Any deployment running a version earlier than 2025.12.2, 2026.1.1, or 2026.2.0 is impacted. Administrators should verify that their Discourse instance runs at least one of the patched releases; older versions remain susceptible.", "description_and_impact": "Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 let several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) accept requests without an authentication token when no token is configured, and the Mailpace endpoint lacks token validation entirely. This flaw allows an attacker to send forged webhook payloads that can artificially inflate user bounce scores, potentially disabling legitimate user emails. The weakness is an authentication bypass (CWE\u2011287), exposing the integrity of user email delivery metadata.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending unauthenticated requests to the vulnerable webhook endpoints; no additional privileges or network access are required beyond the ability to reach the webhook URL. Once exploited, the attacker can manipulate bounce metrics, potentially leading to spam filtering or user lockout."}}}}, "created": "2026-02-27T09:07:29.548348+00:00", "updated": "2026-04-17T14:30:20.822756+00:00", "vendors": ["discourse", "discourse$PRODUCT$discourse"]}