Vulnerabilities ›

CVE-2026-26078

High

CWE-639 — Weakness Type

                    Published: Feb 26, 2026                      ·  Modified: Mar 5, 2026                      ·  Source: NVD                

CVSS v3

7.5

🔗 NVD Official

📄 Description (English)

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, when the `patreon_webhook_secret` site setting is blank, an attacker can forge valid webhook signatures by computing an HMAC-MD5 with an empty string as the key. Since the request body is known to the sender, the attacker can produce a matching signature and send arbitrary webhook payloads. This allows unauthorized creation, modification, or deletion of Patreon pledge data and triggering patron-to-group synchronization. This vulnerability is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0. The fix rejects webhook requests when the webhook secret is not configured, preventing signature forgery with an empty key. As a workaround, configure the `patreon_webhook_secret` site setting with a strong, non-empty secret value. When the secret is non-empty, an attacker cannot forge valid signatures without knowing the secret.

🤖 AI Executive Summary

Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 contain a critical webhook signature forgery vulnerability when the patreon_webhook_secret setting is blank. Attackers can forge valid HMAC-MD5 signatures using an empty key to send arbitrary Patreon webhook payloads, enabling unauthorized modification of pledge data and patron synchronization. This vulnerability affects community platforms and discussion forums that integrate Patreon without proper webhook secret configuration. Immediate patching or workaround implementation is essential to prevent unauthorized access to patron management systems.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: May 4, 2026 12:47

🇸🇦 Saudi Arabia Impact Assessment

Saudi organizations operating community platforms, discussion forums, or knowledge-sharing portals using Discourse with Patreon integration face significant risk. Most impacted sectors include: (1) Media and Publishing companies using Discourse for community engagement; (2) Educational institutions with patron-supported content platforms; (3) Technology and startup communities hosting discussion forums; (4) Non-profit organizations managing supporter relationships through Patreon. The vulnerability allows attackers to manipulate patron data, disrupt community trust, and potentially compromise financial relationships with supporters. Organizations in the Kingdom relying on Discourse for community management should prioritize immediate remediation.

🏢 Affected Saudi Sectors

Media and Publishing Education Technology and Software Non-profit Organizations Community Platforms Content Creators and Influencers

🎯 MITRE ATT&CK Techniques

T1021 - Remote Services (webhook exploitation) T1550 - Use Alternate Authentication Material (forged signatures) T1578 - Modify Cloud Compute Infrastructure (unauthorized data modification) T1565 - Data Manipulation (unauthorized modification of pledge data) T1199 - Trusted Relationship (exploiting Patreon integration trust)

⚖️ Saudi Risk Score (AI)

7.8

/ 10.0

🔧 Remediation Steps (English)

IMMEDIATE ACTIONS:

1. Identify all Discourse instances in your environment and verify current version numbers

2. Check if patreon_webhook_secret site setting is configured (non-empty) in Admin > Settings > Integrations

3. If blank, immediately implement the workaround or schedule emergency patching



PATCHING GUIDANCE:

1. Upgrade to patched versions: 2025.12.2, 2026.1.1, or 2026.2.0 or later

2. Follow Discourse upgrade procedures: backup database, test in staging environment, schedule maintenance window

3. Verify webhook functionality post-upgrade



COMPENSATING CONTROLS (if patching delayed):

1. Configure patreon_webhook_secret with a strong, randomly generated secret (minimum 32 characters)

2. Restrict webhook endpoint access via firewall/WAF to known Patreon IP ranges

3. Implement request logging and monitoring for /webhooks/patreon endpoint

4. Disable Patreon integration temporarily if not actively used



DETECTION RULES:

1. Monitor for POST requests to /webhooks/patreon with suspicious patterns

2. Alert on failed webhook signature validation attempts

3. Track unauthorized changes to patron data or group synchronization events

4. Log all modifications to patreon_webhook_secret setting

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. حدد جميع مثيلات Discourse في بيئتك وتحقق من أرقام الإصدار الحالية

2. تحقق مما إذا تم تكوين إعداد patreon_webhook_secret (غير فارغ) في Admin > Settings > Integrations

3. إذا كان فارغًا، قم فورًا بتنفيذ الحل البديل أو جدولة التصحيح الطارئ

إرشادات التصحيح:

1. قم بالترقية إلى الإصدارات المصححة: 2025.12.2 أو 2026.1.1 أو 2026.2.0 أو أحدث

2. اتبع إجراءات ترقية Discourse: نسخ احتياطي من قاعدة البيانات، اختبار في بيئة التطوير، جدولة نافذة الصيانة

3. تحقق من وظائف webhook بعد الترقية

الضوابط البديلة (إذا تأخر التصحيح):

1. قم بتكوين patreon_webhook_secret بسر قوي وعشوائي (32 حرفًا على الأقل)

2. قيد وصول نقطة نهاية webhook عبر جدار الحماية/WAF إلى نطاقات IP المعروفة من Patreon

3. تنفيذ تسجيل المراقبة لنقطة نهاية /webhooks/patreon

4. تعطيل تكامل Patreon مؤقتًا إذا لم يكن قيد الاستخدام النشط

قواعد الكشف:

1. راقب طلبات POST إلى /webhooks/patreon بأنماط مريبة

2. تنبيهات محاولات التحقق من توقيع webhook الفاشلة

3. تتبع التغييرات غير المصرح بها على بيانات الراعي أو أحداث مزامنة المجموعة

4. تسجيل جميع التعديلات على إعداد patreon_webhook_secret

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 A.14.2.1 - Information security requirements for supplier relationships (webhook integration security) ECC 2024 A.14.2.5 - Supplier security incident management ECC 2024 A.12.6.1 - Management of technical vulnerabilities

🔵 SAMA CSF

SAMA CSF ID.BE-3 - Organizational governance and risk management SAMA CSF PR.AC-1 - Access control and authentication mechanisms SAMA CSF PR.DS-2 - Data security and integrity controls SAMA CSF DE.CM-1 - Detection and monitoring of anomalous activities

🟡 ISO 27001:2022

ISO 27001:2022 A.5.23 - Information security for supplier relationships ISO 27001:2022 A.8.1 - User endpoint devices and facilities ISO 27001:2022 A.8.3 - Access control ISO 27001:2022 A.12.6 - Management of technical vulnerabilities

🟣 PCI DSS v4.0.1

PCI DSS 6.2 - Security patches and updates PCI DSS 6.5.10 - Broken authentication and session management

🔗 References & Sources 1

🔗

https://github.com/discourse/discourse/security/advisories/GHSA-frx4-wg35-4r68

security-advisories@github.com

Vendor Advisory

📦 Affected Products / CPE 3 entries

discourse:discourse

discourse:discourse:2026.2.0

📊 CVSS Score

7.5

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityN — None / Network

IntegrityH — High

AvailabilityN — None / Network

📋 Quick Facts

Severity High

CVSS Score7.5

CWECWE-639

EPSS0.04%

Exploit No

Patch ✓ Yes

Published 2026-02-26

Source Feed nvd

🇸🇦 Saudi Risk Score

7.8

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

CWE-639

🏢 Vendor Advisories

🔗 https://github.com/discourse/discourse/security/advi...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-26078

💬 Comments

Introduce Yourself

Sign In Required