CVE-2026-47263 Details
Description
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the MessageBus.publish call for /web_hook_events/<id> in Jobs::RedeliverWebHookEvents did not pass group_ids, leaving the channel readable by any authenticated user (or anonymous user on instances where login_required is disabled). Webhook IDs are sequential integers and trivially enumerable. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
A vulnerability in Discourse's webhook redelivery process allows unauthorized access to webhook payloads. This issue affects Discourse versions 2026.1.0-latest to prior to 2026.1.4, 2026.3.0-latest to prior to 2026.3.1, and 2026.4.0-latest to prior to 2026.4.1. The vulnerability arises because the MessageBus.publish call for /web_hook_events/<id> in Jobs::RedeliverWebHookEvents did not include group_ids, making the channel accessible to any authenticated user or anonymous user on instances with login_required disabled. Webhook IDs are sequential and easily guessable, allowing non-staff subscribers to receive sensitive information such as private post bodies, user PII, or unauthorized response data from third-party services.
Users can upgrade to Discourse versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/discourse/discourse/security/advisories/GHSA-wvrm-9v64-m96p | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| discourse discourse | < 2026.1.0 >= 2026.1.0, < 2026.1.4 >= 2026.3.0, < 2026.3.1 >= 2026.4.0, < 2026.4.1 2026.5.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |