CVE-2026-26077: 
NixOS vulnerability analysis and mitigation

CVE-2026-26077 is an improper authentication vulnerability in Discourse, an open-source discussion platform, affecting its email webhook endpoints. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) in the WebhooksController accepted requests without a valid authentication token when no token was configured, and the Mailpace endpoint had no token validation at all. The vulnerability was published on February 26, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-287 (Improper Authentication): the WebhooksController in Discourse failed to enforce token-based authentication on inbound webhook requests when no token had been configured in site settings, effectively treating the absence of a configured secret as a bypass condition rather than a denial condition. An unauthenticated remote attacker can send crafted HTTP POST requests to the affected webhook endpoints (e.g., those handling bounce notifications from SendGrid, Mailjet, Mandrill, Postmark, or SparkPost) with forged payload data. The Mailpace endpoint was particularly exposed as it performed no token validation under any configuration. The fix enforces a 406 (Not Acceptable) response for all webhook requests when no authentication token is configured, closing the bypass (GitHub Advisory).

Successful exploitation allows unauthenticated attackers to forge webhook payloads and artificially inflate user bounce scores within Discourse, which can cause the platform to automatically disable email delivery for legitimate user accounts. This results in a low integrity impact (manipulation of bounce score data) and a low availability impact (disruption of email communication for affected users), with no confidentiality impact. While the vulnerability does not enable code execution or data exfiltration, it can be used to selectively silence or lock out users from email-based notifications and account recovery flows (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity, making it straightforward for any remote attacker to attempt if a Discourse instance lacks configured webhook tokens. The EPSS score is approximately 0.041%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify publicly accessible Discourse instances running versions prior to 2025.12.2, 2026.1.1, or 2026.2.0. Check for exposed webhook endpoints by reviewing the Discourse version or probing known webhook URL paths.
2. Identify target endpoint: Locate the webhook receiver URLs for email providers (e.g., /webhooks/sendgrid, /webhooks/mailjet, /webhooks/postmark, /webhooks/sparkpost, /webhooks/mailpace) on the target Discourse instance.
3. Craft forged payload: Construct an HTTP POST request mimicking a legitimate bounce notification from the relevant email provider (e.g., a SendGrid bounce event JSON payload with a target user's email address and a high bounce score).
4. Send unauthenticated request: Submit the forged POST request to the webhook endpoint without any authentication token. If no token is configured on the server, the request will be accepted and processed.
5. Inflate bounce score: Repeat the request as needed to artificially inflate the target user's bounce score in Discourse, triggering the platform's automatic email suppression logic and disabling email delivery for the targeted account (GitHub Advisory).

• Network: Unusual or repeated HTTP POST requests to Discourse webhook endpoints such as /webhooks/sendgrid, /webhooks/mailjet, /webhooks/mandrill, /webhooks/postmark, /webhooks/sparkpost, or /webhooks/mailpace from IP addresses not associated with the legitimate email provider's IP ranges.
• Logs: Web server or application logs showing a high volume of POST requests to webhook paths without valid authentication headers or tokens; requests originating from unexpected geographic locations or IP ranges.
• Application Behavior: Unexpected increases in user bounce scores visible in the Discourse admin panel; legitimate users reporting sudden loss of email notifications or inability to receive password reset emails without any corresponding email delivery failures from the actual email provider.

Discourse has released patched versions 2025.12.2, 2026.1.1, and 2026.2.0, which enforce a 406 response for all webhook requests when no authentication token is configured. Administrators should upgrade to one of these versions as the primary remediation. As an interim workaround for all providers except Mailpace, configure webhook authentication tokens in Discourse site settings: sendgrid_verification_key, mailjet_webhook_token, postmark_webhook_token, and sparkpost_webhook_token. Note that there is no workaround for the Mailpace endpoint prior to applying the patch — upgrading is mandatory to secure that endpoint (GitHub Advisory).

The vulnerability was disclosed by Discourse maintainer davidtaylorhq via a GitHub Security Advisory on February 26, 2026. Coverage has been limited to vulnerability aggregation services and security news feeds, with no notable independent researcher commentary or significant social media discussion identified. The moderate severity rating and lack of code execution impact appear to have limited broader community reaction (GitHub Advisory).