Discourse CVE-2026-47263 Webhook Redelivery Information Disclosure

Vulnerability Overview This vulnerability involves the disclosure of webhook payloads during event redelivery. Specifically, when webhook events are redelivered via in Jobs, the are not filtered, allowing any authenticated user (including anonymous users if login requirements are disabled) to read channels. Webhook IDs are sequential integers and can be easily enumerated. Affected Versions Affected Versions: - - - - Fixed Versions: - - - - Fix Upgrade to the fixed version. Detailed Description Impact The call within does not filter , allowing any authenticated user (including anonymous users if login requirements are disabled) to read channels. Webhook IDs are sequential integers and can be easily enumerated. The published payload is the complete JSON — including request URL, request headers, request body, response headers, and response body — meaning non-employee subscribers can receive webhook content that may contain private post bodies, user PII, or response data from third-party endpoints, which they are not authorized to access. This vulnerability is caused by webhook redelivery triggered through the admin "Redeliver" / "Redeliver Failed" UI and processed by a job scheduled via . While within Jobs is restricted to emit only minimal payloads for employee groups, the redelivery path does not have this restriction. Workaround Upgrade to the fixed version. Severity CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: Low - Integrity: None - Availability: None CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE ID CVE-2026-47263 Weakness Weakness CWE-200

Goal Reached Thanks to every supporter — we hit 100%!

Discourse CVE-2026-47263 Webhook Redelivery Information Disclosure

More from this source