CVE-2026-47263: Discourse Webhook Event Information Disclosure – Medium Severity

Technical summary

The vulnerability exists in the Jobs::RedeliverWebHookEvents job, which publishes retry notifications via MessageBus to the channel /web_hook_events/<id>. The publish call omits the group_ids parameter, failing to restrict channel subscriptions to authorized users. Combined with sequential, enumerable webhook IDs, an attacker can subscribe to arbitrary webhook event channels and observe all retry traffic. The flaw affects all instances running Discourse 2026.1.0–2026.1.3, 2026.3.0–2026.3.0, and 2026.4.0–2026.4.0. Patched versions are 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 and later.

Business impact

Webhook events often carry sensitive metadata about your community: user registrations, post approvals, moderation actions, group membership changes, or custom application state. Unauthorized disclosure of this stream could inform attackers about community structure, administrative workflows, or integrated third-party systems. On public Discourse instances (login_required: false), any internet visitor can passively monitor webhook activity. On private instances, any registered member gains access. The sequential nature of webhook IDs means enumeration is trivial and does not require any credential cycling or brute-force.

Affected systems

Discourse self-hosted and cloud instances running versions 2026.1.0 through 2026.1.3, 2026.3.0, or 2026.4.0. Patch immediately to 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 or later. Administrators should verify their current version under Admin → About and cross-check against the patched releases listed in the official Discourse security advisory.

Exploitability

Exploitation requires no special tools or authentication bypass. An attacker with basic access to your Discourse instance (or no access if login_required is disabled) can open the browser console or use standard WebSocket clients to subscribe to MessageBus channels. Discovering valid webhook IDs is straightforward: start with ID 1 and increment. No user interaction is required beyond passive subscription. The attack surface is high on public instances and moderate on private ones with many registered users.

Remediation

Upgrade Discourse to patched versions: 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 and later. Verify the patch by confirming your version in Admin → About matches a fixed release. If you manage multiple Discourse instances, prioritize those with login_required: false and active webhooks. After patching, consider auditing webhook logs and any downstream systems that consume webhook events to assess whether sensitive data was accessed during the exposure window.

Patch guidance

Discourse administrators should initiate an upgrade to the latest patched version immediately. For self-hosted instances, follow the standard Discourse upgrade process documented in your deployment guide (Docker, Omnibus, or source). Cloud-hosted customers should check their Discourse hosting provider's dashboard for automatic or one-click upgrade options. Verify the upgrade by navigating to Admin → About and confirming the version number matches 2026.1.4, 2026.3.1, 2026.4.1, 2026.5.0-latest.1, or any later release. Restart or redeploy your containers/services after patching.

Detection guidance

Review MessageBus subscription logs (if available) for unusual subscriptions to /web_hook_events/* channels from unexpected IP addresses or user accounts. Monitor webhook delivery logs for anomalies in request patterns or failures that coincide with the patching window. If your Discourse instance logs authentication or access events, correlate them with webhook redelivery job execution times. Inspect webhook endpoints and downstream integrations for evidence of unexpected consumption or parsing of webhook payloads during the vulnerability exposure period.

Why prioritize this

Although the CVSS score is moderate (4.3), the confluence of low barrier to exploitation, passive data exfiltration, and potential exposure of sensitive operational metadata elevates practical risk. Public instances and those with many webhooks warrant urgent patching. The ease of enumeration and lack of authentication requirement make this a high-value target for reconnaissance.

Risk score, explained

CVSS 4.3 (Medium) reflects low attack complexity and no user interaction required, but assumes an unauthenticated attacker on a public instance and limited confidentiality impact. In practice, the exposure scope varies by configuration: private instances require valid credentials but are still vulnerable; public instances need no credentials. The score does not account for sequential ID enumeration, which makes discovery nearly cost-free. Organizations with webhooks tied to sensitive workflows should treat this as a higher operational priority than the base CVSS indicates.

Frequently asked questions