What is the CVSS score of CVE-2026-47263?

CVE-2026-47263 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-47263?

Yes, a patch is available for CVE-2026-47263. Update the affected software to the latest version immediately.

Discourse CVE-2026-47263

EUVD-2026-36560 MEDIUM

Information Exposure (CWE-200)

2026-06-12 GitHub_M

Information Disclosure Discourse

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible with no complexity, no privileges, and no user interaction needed; confidentiality impact is low and integrity/availability are unaffected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 12, 2026 - 22:01 EUVD

Analysis Generated

Jun 12, 2026 - 21:30 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the MessageBus.publish call for /web_hook_events/<id> in Jobs::RedeliverWebHookEvents did not pass group_ids, leaving the channel readable by any authenticated user (or anonymous user on instances where login_required is disabled). Webhook IDs are sequential integers and trivially enumerable. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

AnalysisAI

Unauthorized access to webhook event data in Discourse exposes internal webhook payloads to any authenticated user - or unauthenticated users on instances with login_required disabled - across versions 2026.1.0 through several branch heads. The flaw resides in the MessageBus channel /web_hook_events/<id>, which the Jobs::RedeliverWebHookEvents job publishes to without enforcing group_id restrictions, allowing unrestricted channel subscription. Compounded by trivially enumerable sequential integer webhook IDs, any low-privilege or anonymous actor can iterate over webhook event history without authorization. No public exploit code exists and EPSS is 0.03% (9th percentile), indicating no observed widespread exploitation at time of analysis.

Technical ContextAI

Discourse uses MessageBus, an in-process pub/sub messaging layer, to push real-time updates to browser clients. When Jobs::RedeliverWebHookEvents publishes to the /web_hook_events/<id> channel, it omits the group_ids parameter that normally gates channel visibility to specific user groups. Without this restriction, MessageBus defaults to open broadcast. The affected CPE is cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* across the identified version ranges. The root cause maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) - a missing access-control enforcement at the messaging layer rather than at the HTTP routing layer. The sequential-integer nature of webhook IDs compounds the issue, reducing any practical obscurity and enabling IDOR-style enumeration without brute-force complexity.

RemediationAI

Vendor-released patches are confirmed in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 - upgrade to the appropriate patched release for your branch. Full details are available in the vendor advisory at https://github.com/discourse/discourse/security/advisories/GHSA-wvrm-9v64-m96p. If immediate upgrade is not possible, enabling login_required (Site Settings → login_required) eliminates the anonymous-access vector, restricting the channel to authenticated users only - note this changes the site's public accessibility posture. As a deeper compensating control, restrict the network perimeter so that the Discourse MessageBus endpoint is not reachable by untrusted networks; however, this is impractical for publicly hosted communities. There is no known workaround that preserves webhook redelivery functionality while fully blocking the unauthorized channel subscription without patching.