CVE-2026-47263 Overview
CVE-2026-47263 is an information disclosure vulnerability in Discourse, an open-source discussion platform. The flaw resides in the Jobs::RedeliverWebHookEvents job, where the MessageBus.publish call for the /web_hook_events/<id> channel omits the group_ids parameter. This omission leaves the channel readable by any authenticated user, or by anonymous users on instances with login_required disabled. Webhook IDs are sequential integers, making them trivially enumerable by an attacker. The issue affects versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1. The vulnerability is categorized under [CWE-200] (Exposure of Sensitive Information).
Critical Impact
Low-privileged or anonymous users can subscribe to webhook event channels and harvest sensitive webhook payload data by enumerating sequential webhook IDs.
Affected Products
- Discourse versions 2026.1.0-latest to before 2026.1.4
- Discourse versions 2026.3.0-latest to before 2026.3.1
- Discourse versions 2026.4.0-latest to before 2026.4.1
Discovery Timeline
- 2026-06-12 - CVE-2026-47263 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-47263
Vulnerability Analysis
Discourse uses the MessageBus library to deliver real-time messages to clients over persistent channels. The MessageBus.publish API accepts a group_ids argument that restricts which user groups can subscribe to a channel. When this argument is omitted, the channel defaults to being readable by all clients connected to the message bus.
In the affected versions, Jobs::RedeliverWebHookEvents publishes webhook redelivery events to the /web_hook_events/<id> channel without supplying group_ids. As a result, any authenticated user can subscribe to these channels and observe webhook event data. On instances where login_required is disabled, anonymous users gain the same visibility.
Webhook IDs are sequential integers, so an attacker can enumerate the full set of webhook events by iterating numerically. The exposed data may include webhook payloads, delivery status, and metadata that the site administrator intended to keep private.
Root Cause
The root cause is missing access control on a real-time message channel. The group_ids parameter, which enforces group-scoped subscription on MessageBus channels, was not passed in the webhook redelivery job. This is a classic [CWE-200] information exposure pattern, where sensitive resources are published without authorization metadata.
Attack Vector
An attacker authenticates to the Discourse instance, or connects anonymously when login_required is disabled. The attacker then subscribes to /web_hook_events/<id> channels through the MessageBus client interface, incrementing <id> sequentially. Each subscription returns webhook event data published by administrators triggering redelivery. No user interaction from the victim is required beyond the redelivery action.
No verified public exploit code is available. See the GitHub Security Advisory for additional technical context.
Detection Methods for CVE-2026-47263
Indicators of Compromise
- Unusual volume of MessageBus subscription requests targeting /web_hook_events/ channels with sequential numeric IDs from a single client.
- Authenticated low-privilege accounts polling MessageBus endpoints at high frequency.
- Anonymous MessageBus subscriptions on instances where login_required is disabled.
Detection Strategies
- Inspect Discourse application logs and reverse proxy logs for repeated requests to /message-bus/ endpoints referencing web_hook_events channels.
- Correlate webhook redelivery events triggered by administrators with subsequent MessageBus subscription spikes from non-admin sessions.
- Audit Discourse instances to confirm version strings match patched releases.
Monitoring Recommendations
- Enable verbose access logging on the Discourse front-end proxy and forward logs to a centralized analytics platform.
- Set rate-limit alerts on MessageBus subscription endpoints to flag enumeration patterns.
- Track the login_required setting and alert on configuration changes that expose channels to anonymous users.
How to Mitigate CVE-2026-47263
Immediate Actions Required
- Upgrade Discourse to 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 immediately.
- Enable login_required on instances that do not require public access to reduce the exposure surface to authenticated users only.
- Review webhook configurations and rotate any secrets that may have been transmitted through webhook payloads while affected versions were running.
Patch Information
Discourse has released fixed versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1. The patch adds the group_ids argument to the MessageBus.publish call in Jobs::RedeliverWebHookEvents, restricting the /web_hook_events/<id> channel to administrators. Refer to the Discourse Security Advisory GHSA-wvrm-9v64-m96p for full details.
Workarounds
- Temporarily disable webhook redelivery operations until the patch can be applied.
- Restrict MessageBus subscription endpoints at the reverse proxy layer to known administrator IP ranges.
- Avoid triggering webhook redelivery on production instances running affected versions.
# Verify the installed Discourse version against the patched releases
cd /var/discourse
git -C /var/www/discourse describe --tags
# Upgrade using the standard launcher workflow
./launcher rebuild app
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
