Executive brief
Discourse, a popular open-source discussion and forum platform, contained a flaw that could allow unauthorized users to view sensitive webhook data. When an administrator re-sent a failed webhook notification, the system accidentally broadcasted the full details—including private message content and user information—to a channel that any logged-in user could access. This could lead to the exposure of private community data or personal information to unauthorized members.
Technical details
An information disclosure vulnerability exists in Discourse's webhook redelivery mechanism. The 'Jobs::RedeliverWebHookEvents' component failed to restrict the 'MessageBus.publish' call to specific 'group_ids', making the '/web_hook_events/<id>' channel accessible to any authenticated user (or anonymous users if 'login_required' is disabled). Because webhook IDs are sequential and easily guessed, an attacker can subscribe to these channels to intercept full 'AdminWebHookEventSerializer' payloads. These payloads contain sensitive data including request/reponse headers, bodies, and potentially PII or private post content. The vulnerability is triggered when an administrator initiates a webhook redelivery via the UI. Patches are available in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected products
- Discourse Discourse 2026.1.0-latest to 2026.1.3, 2026.3.0-latest to 2026.3.0, 2026.4.0-latest to 2026.4.0
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD