Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 let several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) accept requests without an authentication token when no token is configured, and the Mailpace endpoint lacks token validation entirely. This flaw allows an attacker to send forged webhook payloads that can artificially inflate user bounce scores, potentially disabling legitimate user emails. The weakness is an authentication bypass (CWE‑287), exposing the integrity of user email delivery metadata.

The vulnerability affects installations of the open‑source discussion platform Discourse. Any deployment running a version earlier than 2025.12.2, 2026.1.1, or 2026.2.0 is impacted. Administrators should verify that their Discourse instance runs at least one of the patched releases; older versions remain susceptible.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending unauthenticated requests to the vulnerable webhook endpoints; no additional privileges or network access are required beyond the ability to reach the webhook URL. Once exploited, the attacker can manipulate bounce metrics, potentially leading to spam filtering or user lockout.