CVE-2026-26077

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) in the `WebhooksController` accepted requests without a valid authentication token when no token was configured. This allowed unauthenticated attackers to forge webhook payloads and artificially inflate user bounce scores, potentially causing legitimate user emails to be disabled. The Mailpace endpoint had no token validation at all. Starting in versions 2025.12.2, 2026.1.1, and 2026.2.0, all webhook endpoints reject requests with a 406 response when no authentication token is configured. As a workaround, ensure that webhook authentication tokens are configured for all email provider integrations in site settings (e.g., `sendgrid_verification_key`, `mailjet_webhook_token`, `postmark_webhook_token`, `sparkpost_webhook_token`). There's no current workaround for mailpace before getting this fix.

• CWE-287

• https://github.com/discourse/discourse/security/advisories/GHSA-j67c-53j2-4hfwVendor Advisory

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26071EVerest is an EV charging software stack. Versions prior to …4.2
• CVE-2026-26072EVerest is an EV charging software stack. Versions prior to …4.2
• CVE-2026-26073EVerest is an EV charging software stack. Versions prior to …5.9
• CVE-2026-26074EVerest is an EV charging software stack. Versions prior to …7
• CVE-2026-26075FastGPT is an AI Agent building platform. Due to the fact th…5.4
• CVE-2026-26076ntpd-rs is a full-featured implementation of the Network Tim…7.5
• CVE-2026-26078Discourse is an open source discussion platform. Prior to ve…7.5
• CVE-2026-26079Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows…4.7
• CVE-2026-2608The Kadence Blocks — Page Builder Toolkit for Gutenberg Edit…4.3
• CVE-2026-26080HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 c…3.7
• CVE-2026-26081HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks…4.8
• CVE-2026-26083A missing authorization vulnerability in Fortinet FortiSandb…9.8