# CVE-2026-26077: Discourse - Authentication Bypass

> Live exploitation tracking for CVE-2026-26077 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-26077

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.5
- **Public exploit available:** Yes
- **Affected products:** Discourse
- **Weaknesses:** CWE-287 (Improper Authentication)
- **Tags:** forum

## Description

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) in the `WebhooksController` accepted requests without a valid authentication token when no token was configured. This allowed unauthenticated attackers to forge webhook payloads and artificially inflate user bounce scores, potentially causing legitimate user emails to be disabled. The Mailpace endpoint had no token validation at all. Starting in versions 2025.12.2, 2026.1.1, and 2026.2.0, all webhook endpoints reject requests with a 406 response when no authentication token is configured. As a workaround, ensure that webhook authentication tokens are configured for all email provider integrations in site settings (e.g., `sendgrid_verification_key`, `mailjet_webhook_token`, `postmark_webhook_token`, `sparkpost_webhook_token`). There's no current workaround for mailpace before getting this fix.

## CrowdSec analysis

[CVE-2026-26077](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-26077) is an authentication bypass vulnerability in Discourse that affects several email-provider webhook endpoints when no authentication token is configured, with the Mailpace endpoint lacking token validation entirely. Unauthenticated attackers can forge webhook payloads to inflate users’ email bounce scores, potentially causing legitimate email delivery to be disabled; the issue is fixed in versions 2025.12.2, 2026.1.1, and 2026.2.0.

CrowdSec has been tracking this vulnerability and its exploits since 20th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-26077 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target the `/webhooks/mailpace` endpoint with unauthenticated JSON webhook requests containing forged `email.bounced` events. These requests can inflate a user's bounce score and cause legitimate email delivery to be disabled.

## Timeline

- 2026-02-26: CVE Published. CVE-2026-26077 is published to NVD.
- 2026-10-20: Rule Released. CrowdSec releases a rule to detect CVE-2026-26077 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/discourse/discourse/security/advisories/GHSA-j67c-53j2-4hfw
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-26077.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-26077) follows observed exploitation activity for CVE-2026-26077. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.