Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, when the `patreon_webhook_secret` site setting is blank, an attacker can forge valid webhook signatures by computing an HMAC-MD5 with an empty string as the key. Since the request body is known to the sender, the attacker can produce a matching signature and send arbitrary webhook payloads. This allows unauthorized creation, modification, or deletion of Patreon pledge data and triggering patron-to-group synchronization. This vulnerability is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0. The fix rejects webhook requests when the webhook secret is not configured, preventing signature forgery with an empty key. As a workaround, configure the `patreon_webhook_secret` site setting with a strong, non-empty secret value. When the secret is non-empty, an attacker cannot forge valid signatures without knowing the secret.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-02-26 | 1 | Disclosure1 |
| 2026-03-03 | 2 | General1Patch1 |
A high-severity authentication bypass (CVE-2026-26078) affects the Discourse Patreon plugin webhook. Update to version 2026.1.1 to mitigate unauthorized access risk. #Discourse #InfoSec #Vulnerability https://www.pulsepatch.io/posts/cve-2026-26078-discourse-patreon-auth-bypass
Post summary
High‑severity authentication bypass in the Discourse Patreon plugin; updating to version 2026.1.1 is recommended to mitigate the risk.
CVE-2026-26078 (CVSS:7.5, HIGH) is Analyzed. Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, when the `patreon_..https://nvd.nist.gov/vuln/detail/CVE-2026-26078 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post references CVE-2026-26078 with a CVSS score of 7.5, noting affected Discourse versions but provides no details on exploitation, patches, or technical specifics.
CVE-2026-26078 Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, when the `patreon_webhook_secret` site setting is blank, an atta… https://www.cve.org/CVERecord?id=CVE-2026-26078
Post summary
CVE‑2026‑26078 is a vulnerability in Discourse that allows attackers to exploit a missing `patreon_webhook_secret` setting in older releases, potentially enabling unauthorized actions.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | discourse | discourse | - | - | - |
| App | discourse | discourse | 2026.2.0 | - | - |