Discourse não garante que os webhooks requeiram um token

The core impact of CVE-2026-26077 lies in the ability of an attacker to manipulate Discourse's webhook system. Webhooks are used to send notifications to external services (like email providers) when certain events occur within Discourse. By forging these webhook payloads without authentication, an attacker can artificially inflate a user's bounce rate. This can trigger Discourse's anti-spam measures, leading to legitimate user emails being blocked or disabled. The Mailpace endpoint presented an even greater risk, lacking any token validation whatsoever, making exploitation trivial. This vulnerability could disrupt communication and negatively impact user experience.

Discourse installations utilizing external email services via webhooks are at risk. This includes organizations relying on Discourse for community forums, online learning platforms, or any application integrating with email marketing or notification services. Shared hosting environments running Discourse are particularly vulnerable, as misconfigurations on one instance could potentially impact others.

• linux / server:

journalctl -u discourse -g 'webhook' | grep -i 'error'

• generic web:

curl -I https://your-discourse-instance.com/webhooks/sendgrid/endpoint | grep -i '401 unauthorized'

• discourse: Check Discourse admin panel for webhook token configuration. Ensure tokens are enabled and not empty for all endpoints.

1. 2026-02-26Disclosure

   disclosure

1. Reservado2026-02-10
2. Publicada2026-02-26
3. Modificada2026-02-27
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2026-26077 is to upgrade Discourse to version 2026.2.0 or later, which includes the necessary authentication checks. If an immediate upgrade is not feasible, consider temporarily disabling the vulnerable webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) within the Discourse admin panel. Review your Discourse configuration to ensure that webhook tokens are properly configured and enforced. Monitor your Discourse logs for suspicious webhook activity, particularly unusual spikes in bounce rates or unauthorized requests to these endpoints. After upgrading, confirm the fix by attempting to manually trigger a webhook payload without proper authentication; it should be rejected.