CVE-2026-26077: Discourse Auth Bypass Vulnerability

CVE-2026-26077 Overview

CVE-2026-26077 is an authentication bypass vulnerability affecting Discourse, an open source discussion platform. The vulnerability exists in several webhook endpoints within the WebhooksController, including SendGrid, Mailjet, Mandrill, Postmark, and SparkPost integrations. These endpoints accept requests without a valid authentication token when no token is configured, allowing unauthenticated attackers to forge webhook payloads and artificially inflate user bounce scores. This could result in legitimate user emails being disabled, disrupting normal platform communication. The Mailpace endpoint is particularly vulnerable as it had no token validation at all.

Critical Impact
Unauthenticated attackers can forge webhook payloads to inflate bounce scores and disable legitimate user email addresses, potentially disrupting platform communication and user access.

Affected Products

Discourse versions prior to 2025.12.2
Discourse versions prior to 2026.1.1
Discourse versions prior to 2026.2.0

Discovery Timeline

February 26, 2026 - CVE-2026-26077 published to NVD
February 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-26077

Vulnerability Analysis

This vulnerability is classified under CWE-287 (Improper Authentication). The core issue stems from insufficient authentication validation in the webhook endpoints responsible for handling email provider callbacks. When Discourse administrators have not configured authentication tokens for their email provider integrations, the system fails to reject unauthenticated requests. Instead, it accepts any incoming webhook payload as legitimate.

The affected endpoints handle email delivery status notifications from external email service providers. These webhooks typically report bounce events, delivery confirmations, and other email-related metrics. By accepting forged webhook requests, an attacker can manipulate the bounce score mechanism that Discourse uses to track email delivery health for user accounts.

Root Cause

The root cause is improper authentication handling in the WebhooksController class. The webhook endpoints for SendGrid, Mailjet, Mandrill, Postmark, and SparkPost were designed to validate authentication tokens but failed to enforce this validation when no token was configured. Rather than requiring a token to be set before accepting any requests, the endpoints would simply skip validation entirely, creating an authentication bypass condition. The Mailpace endpoint compounded this issue by having no token validation mechanism implemented at all.

Attack Vector

An attacker with network access can exploit this vulnerability by sending crafted HTTP requests directly to the vulnerable webhook endpoints. The attack does not require any authentication credentials or prior access to the Discourse installation.

The exploitation flow involves:

Identifying a Discourse installation with unconfigured or missing webhook authentication tokens
Crafting malicious webhook payloads that mimic legitimate email provider bounce notifications
Sending these forged payloads to the affected webhook endpoints (e.g., /webhooks/sendgrid, /webhooks/mailjet, /webhooks/mailpace)
The system processes these fake bounce events and increments the target user's bounce score
Once the bounce score exceeds the configured threshold, Discourse automatically disables email delivery to the affected user

This attack can be used to selectively disable email notifications for specific users, preventing them from receiving password reset emails, notification digests, or other critical communications.

Detection Methods for CVE-2026-26077

Indicators of Compromise

Unusual spike in webhook requests to email provider endpoints without corresponding email delivery activity
Multiple users reporting missing email notifications or disabled email settings
Sudden increases in user bounce scores without legitimate bounce events from email providers
Webhook requests originating from IP addresses not associated with configured email service providers

Detection Strategies

Monitor web server access logs for POST requests to webhook endpoints (/webhooks/sendgrid, /webhooks/mailjet, /webhooks/mailpace, /webhooks/mandrill, /webhooks/postmark, /webhooks/sparkpost)
Cross-reference webhook activity with actual email provider logs to identify discrepancies
Implement alerting for users whose bounce scores increase rapidly without corresponding delivery failures in email provider dashboards
Review Discourse admin logs for unexpected changes to user email settings

Monitoring Recommendations

Configure web application firewall (WAF) rules to validate webhook request source IPs against known email provider IP ranges
Set up anomaly detection for webhook request volume and patterns
Enable detailed logging on all webhook endpoints for forensic analysis capabilities
Monitor user account status changes related to email delivery settings

How to Mitigate CVE-2026-26077

Immediate Actions Required

Upgrade Discourse to version 2025.12.2, 2026.1.1, or 2026.2.0 or later immediately
Audit current webhook authentication token configuration in site settings
Review user bounce scores for any suspicious inflation that may indicate prior exploitation
Reset bounce scores for affected users if unauthorized manipulation is suspected

Patch Information

The vulnerability is fixed in Discourse versions 2025.12.2, 2026.1.1, and 2026.2.0. The patch ensures all webhook endpoints reject requests with a 406 response when no authentication token is configured, preventing unauthenticated access. Administrators should update to the latest stable release to receive this security fix. For detailed patch information, see the GitHub Security Advisory.

Workarounds

Configure webhook authentication tokens for all email provider integrations in site settings before upgrading
Set sendgrid_verification_key for SendGrid integration
Set mailjet_webhook_token for Mailjet integration
Set postmark_webhook_token for Postmark integration
Set sparkpost_webhook_token for SparkPost integration
Note: There is no workaround available for Mailpace before applying the patch - upgrade is required

bash

# Configuration example - verify webhook tokens are configured
# Access Discourse admin panel and navigate to:
# Admin > Settings > Email
# Ensure the following settings are configured with secure tokens:
# - sendgrid_verification_key
# - mailjet_webhook_token
# - postmark_webhook_token
# - sparkpost_webhook_token