Authentication Bypass in Discourse Webhooks from Discourse

CVE-2026-26077

What is CVE-2026-26077?

Discourse, an open-source discussion platform, contained a vulnerability allowing unauthenticated access to several webhook endpoints (including SendGrid, Mailjet, Mandrill, Postmark, SparkPost) in the WebhooksController. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, these endpoints accepted requests without requiring a valid authentication token, risking the integrity of user accounts. This flaw enabled malicious actors to forge webhook payloads, potentially inflating legitimate user bounce scores and leading to account-related issues. The Mailpace endpoint lacked any token validation, exacerbating the problem. Users are advised to configure webhook authentication tokens for all email integrations, with recent versions implementing a 406 response for requests lacking tokens.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References