CVE-2026-26078: Discourse Auth Bypass Vulnerability

CVE-2026-26078 Overview

CVE-2026-26078 is an Authorization Bypass vulnerability affecting Discourse, an open source discussion platform. When the patreon_webhook_secret site setting is left blank, an attacker can forge valid webhook signatures by computing an HMAC-MD5 with an empty string as the key. Since the request body is known to the sender, the attacker can produce a matching signature and send arbitrary webhook payloads to the Discourse instance.

Critical Impact

This vulnerability allows unauthorized creation, modification, or deletion of Patreon pledge data and triggering patron-to-group synchronization, potentially compromising membership access controls and patron rewards.

Affected Products

• Discourse versions prior to 2025.12.2
• Discourse versions prior to 2026.1.1
• Discourse versions prior to 2026.2.0

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-26078 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-26078

Vulnerability Analysis

The vulnerability stems from an Insecure Direct Object Reference (CWE-639) issue in Discourse's Patreon webhook handling mechanism. When the patreon_webhook_secret site setting is not configured (left as an empty string), the HMAC-MD5 signature verification becomes trivially bypassable.

HMAC algorithms use a secret key to generate a message authentication code. When the key is an empty string, anyone with knowledge of the request body can compute a valid HMAC-MD5 signature. Since webhook payloads contain predictable or controllable content, an attacker can craft arbitrary webhook requests that pass signature validation.

This allows an attacker to inject fabricated Patreon pledge events into the Discourse system, leading to unauthorized manipulation of patron data and group memberships that are typically gated behind Patreon subscriptions.

Root Cause

The root cause is a missing validation check for empty webhook secrets before performing signature verification. The application proceeds with HMAC verification even when no secret is configured, effectively allowing any sender who can compute HMAC-MD5 with an empty key to forge valid signatures. Proper defensive coding would reject webhook requests when the secret is not properly configured.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a Discourse instance with the Patreon integration enabled but the webhook secret unconfigured
2. Crafting a malicious webhook payload mimicking legitimate Patreon events (e.g., pledge creation, update, or deletion)
3. Computing the HMAC-MD5 signature of the payload using an empty string as the key
4. Sending the forged webhook request to the Discourse Patreon webhook endpoint

The vulnerability allows an unauthenticated remote attacker to bypass authorization controls and manipulate pledge data, potentially granting unauthorized access to patron-only content or groups.

Detection Methods for CVE-2026-26078

Indicators of Compromise

• Unexpected changes to Patreon pledge records in the Discourse database
• Unusual patron-to-group synchronization events without corresponding Patreon activity
• Webhook requests originating from IP addresses not associated with Patreon infrastructure
• Anomalous patterns in webhook request timing or volume

Detection Strategies

• Monitor webhook endpoint access logs for requests from non-Patreon IP ranges
• Implement alerting on unexpected patron group membership changes
• Review Discourse admin logs for bulk pledge data modifications
• Configure web application firewall rules to baseline and detect anomalous webhook traffic patterns

Monitoring Recommendations

• Enable detailed logging for all Patreon webhook processing events
• Set up alerts for any patron data changes that don't correlate with Patreon platform activity
• Monitor for configuration changes to the patreon_webhook_secret setting
• Implement rate limiting and anomaly detection on webhook endpoints

How to Mitigate CVE-2026-26078

Immediate Actions Required

• Verify the patreon_webhook_secret site setting is configured with a strong, non-empty secret value
• Update Discourse to patched versions 2025.12.2, 2026.1.1, or 2026.2.0
• Audit recent Patreon pledge data and group membership changes for unauthorized modifications
• Review webhook endpoint access logs for suspicious activity

Patch Information

The vulnerability is patched in Discourse versions 2025.12.2, 2026.1.1, and 2026.2.0. The fix rejects webhook requests when the webhook secret is not configured, preventing signature forgery with an empty key. Organizations should upgrade to one of these patched versions immediately. For more details, refer to the GitHub Security Advisory.

Workarounds

• Configure the patreon_webhook_secret site setting with a strong, randomly generated secret value
• Disable the Patreon integration temporarily if it cannot be properly configured
• Implement network-level restrictions to allow webhook requests only from Patreon IP ranges
• Use a reverse proxy or WAF to validate webhook source before requests reach Discourse

# Configuration example - Set a strong webhook secret in Discourse
# Navigate to Admin > Settings > Plugins and search for patreon_webhook_secret
# Generate a strong random secret:
openssl rand -hex 32
# Copy the generated value and paste it into the patreon_webhook_secret setting