An unauthenticated authorization bypass vulnerability in Discourse enables attackers to manipulate Patreon pledge data and synchronization processes by forging webhook signatures.

The flaw exists in the Patreon webhook integration where an empty secret allows HMAC-MD5 signature forgery. This permits an unauthenticated remote attacker to send arbitrary webhook payloads to the application.

Successful exploitation allows unauthorized creation, deletion, or modification of sensitive Patreon pledge records within the Discourse platform. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to data integrity and business operations related to patron management and group synchronization.

Immediate Action: Update the Discourse platform to version 2025.12.2, 2026.1.1, 2026.2.0, or later to implement the mandatory webhook secret validation.

Proactive Monitoring: Review web server and application logs for suspicious incoming webhook requests or unexpected modifications to Patreon-related database entries.

Compensating Controls: If immediate patching is not feasible, configure the patreon_webhook_secret site setting with a strong, non-empty value to prevent signature forgery.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to the integrity of user pledge data. Administrators must prioritize updating to the patched versions immediately or ensuring that a non-empty, cryptographically strong secret is configured for the Patreon integration to neutralize the attack vector.