Is CVE-2026-26077 actively exploited?

No active exploitation of CVE-2026-26077 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-26077 be exploited remotely?

Yes. CVE-2026-26077 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-26077?

CVE-2026-26077 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-26077

MEDIUM

CVE-2026-26077

CWE-287Published: February 26, 2026· Updated: Mar 2, 2026

6.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.3th

Official Description

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) in the `WebhooksController` accepted requests without a valid authentication token when no token was configured. This allowed unauthenticated attackers to forge webhook payloads and artificially inflate user bounce scores, potentially causing legitimate user emails to be disabled. The Mailpace endpoint had no token validation at all. Starting in versions 2025.12.2, 2026.1.1, and 2026.2.0, all webhook endpoints reject requests with a 406 response when no authentication token is configured. As a workaround, ensure that webhook authentication tokens are configured for all email provider integrations in site settings (e.g., `sendgrid_verification_key`, `mailjet_webhook_token`, `postmark_webhook_token`, `sparkpost_webhook_token`). There's no current workaround for mailpace before getting this fix.

NVD Source

Technical Analysis

CVE-2026-26077 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.