Description
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the MessageBus.publish call for /web_hook_events/<id> in Jobs::RedeliverWebHookEvents did not pass group_ids, leaving the channel readable by any authenticated user (or anonymous user on instances where login_required is disabled). Webhook IDs are sequential integers and trivially enumerable. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Published: 2026-06-12
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw in Discourse’s MessageBus.publish implementation omitted group visibility restrictions for the /web_hook_events/<id> channel. As a result, any authenticated user, and on instances where login is not required, even anonymous users could read the payload of webhook events. Because webhook identifiers are sequential integers and can be guessed easily, an attacker can enumerate many webhook IDs and exfiltrate potentially sensitive data from the event payloads.

Affected Systems

Affected systems are Discourse community platform releases 2026.1.0 through just before 2026.1.4, 2026.3.0 through just before 2026.3.1, and 2026.4.0 through just before 2026.4.1. The vulnerability is fixed in release 2026.1.4, 2026.3.1, 2026.4.1, and the later 2026.5.0-latest.1 update.

Risk and Exploitability

The CVSS score of 4.3 classifies the issue as moderate, and the EPSS score of less than 1% indicates a very low probability of exploitation. It is not listed in the CISA KEV catalog. Attackers only need an authenticated session or no login requirement, making the exploit path straightforward for any user on the instance.

Generated by OpenCVE AI on June 12, 2026 at 23:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Discourse to the patched releases (2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1) to fix the information disclosure identified as CWE-200.
  • If an immediate upgrade is not feasible, enforce authentication by setting login_required to true, thereby preventing anonymous read access to the webhook channel (mitigates CWE-200).
  • Review existing webhook configurations and delete or disable any that are unnecessary, a proactive step that limits the data that could be enumerated if upgrade is delayed.

Generated by OpenCVE AI on June 12, 2026 at 23:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 12 Jun 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Discourse
Discourse discourse
Vendors & Products Discourse
Discourse discourse

Fri, 12 Jun 2026 21:00:00 +0000

Type Values Removed Values Added
Description Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the MessageBus.publish call for /web_hook_events/<id> in Jobs::RedeliverWebHookEvents did not pass group_ids, leaving the channel readable by any authenticated user (or anonymous user on instances where login_required is disabled). Webhook IDs are sequential integers and trivially enumerable. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Title Discourse: Prevent webhook payload disclosure on event redelivery
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

Subscriptions

Discourse Discourse
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-06-12T20:26:19.681Z

Reserved: 2026-05-18T23:03:37.229Z

Link: CVE-2026-47263

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-06-12T21:16:23.537

Modified: 2026-06-12T21:16:23.537

Link: CVE-2026-47263

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-12T23:45:26Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor