{"id":"CVE-2026-47263","aliases":["BIT-discourse-2026-47263","EUVD-2026-36560","GHSA-wvrm-9v64-m96p"],"status":"published","title":"Discourse: Prevent webhook payload disclosure on event redelivery","description":"Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the MessageBus.publish call for /web_hook_events/\u003cid\u003e in Jobs::RedeliverWebHookEvents did not pass group_ids, leaving the channel readable by any authenticated user (or anonymous user on instances where login_required is disabled). Webhook IDs are sequential integers and trivially enumerable. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00194,"percentile":0.09155,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-06-12T20:26:19Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"Bitnami","package":"discourse","fixed_in":["2026.1.4","2026.3.1","2026.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"discourse","ranges":[{"type":"SEMVER","events":[{"introduced":"2026.1.0"},{"fixed":"2026.1.4"},{"introduced":"2026.3.0"},{"fixed":"2026.3.1"},{"introduced":"2026.4.0"},{"fixed":"2026.4.1"}]}]}],"products":[{"vendor":"discourse","product":"discourse"}],"references":[{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-wvrm-9v64-m96p","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47263","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47263.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-47263","title":"Discourse: Prevent webhook payload disclosure on event redelivery","description":"Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the MessageBus.publish call for /web_hook_events/\u003cid\u003e in Jobs::RedeliverWebHookEvents did not pass group_ids, leaving the channel readable by any authenticated user (or anonymous user on instances where login_required is disabled). Webhook IDs are sequential integers and trivially enumerable. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.","status":"published","published":"2026-06-12T20:26:19.681Z","modified":"2026-06-15T19:28:02.007Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-36560","description":"Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the MessageBus.publish call for /web_hook_events/\u003cid\u003e in Jobs::RedeliverWebHookEvents did not pass group_ids, leaving the channel readable by any authenticated user (or anonymous user on instances where login_required is disabled). Webhook IDs are sequential integers and trivially enumerable. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.","status":"published","published":"2026-06-12T20:26:19Z","modified":"2026-06-15T19:28:02Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:41.428781Z"}],"nvd":[{"id":"CVE-2026-47263","description":"Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the MessageBus.publish call for /web_hook_events/\u003cid\u003e in Jobs::RedeliverWebHookEvents did not pass group_ids, leaving the channel readable by any authenticated user (or anonymous user on instances where login_required is disabled). Webhook IDs are sequential integers and trivially enumerable. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.","status":"published","published":"2026-06-12T21:16:23.537Z","modified":"2026-06-17T18:41:27.19Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:23.846948Z"}],"osv":[{"id":"CVE-2026-47263","title":"Discourse: Prevent webhook payload disclosure on event redelivery","description":"Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the MessageBus.publish call for /web_hook_events/\u003cid\u003e in Jobs::RedeliverWebHookEvents did not pass group_ids, leaving the channel readable by any authenticated user (or anonymous user on instances where login_required is disabled). Webhook IDs are sequential integers and trivially enumerable. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.","status":"published","published":"2026-06-12T20:26:19.681Z","modified":"2026-10-28T02:30:48.636880703Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:06.231145Z"},{"id":"BIT-discourse-2026-47263","title":"Discourse: Prevent webhook payload disclosure on event redelivery","description":"Discourse is an open-source discussion platform. From versions 2026.1.0 to before 2026.1.4, 2026.3.0 to before 2026.3.1, and 2026.4.0 to before 2026.4.1, the MessageBus.publish call for /web_hook_events/\u003cid\u003e in Jobs::RedeliverWebHookEvents did not pass group_ids, leaving the channel readable by any authenticated user (or anonymous user on instances where login_required is disabled). Webhook IDs are sequential integers and trivially enumerable. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0.","status":"published","published":"2026-06-16T12:37:43.362Z","modified":"2026-09-08T08:46:27.003808231Z","updated_at":"2026-11-02T15:28:29.152062Z"}]}}