6.5

CVE-2026-53961

Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish validly signed forged Bounce notifications that revoke a targeted user email. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Discourse ≫ Discourse Version >= 2026.1.0 < 2026.1.5
Discourse ≫ Discourse Version >= 2026.4.0 < 2026.4.2
Discourse ≫ Discourse Version >= 2026.5.0 < 2026.5.1
Discourse ≫ Discourse Version2026.6.0 SwEditionlatest
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.142
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE-345 Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

https://github.com/discourse/discourse/releases/tag/v2026.1.5
Release Notes
https://github.com/discourse/discourse/releases/tag/v2026.4.2
Release Notes
https://github.com/discourse/discourse/releases/tag/v2026.5.1
Release Notes
https://github.com/discourse/discourse/releases/tag/v2026.6.0
Release Notes
https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x
Vendor Advisory
https://github.com/discourse/discourse/commit/3a3d315a85ef3c6aabfc7e7bb38702059784f06b
Patch
https://github.com/discourse/discourse/commit/61f12e13aa1b760f81d5ff60f12e3a7e77434b94
Patch
https://github.com/discourse/discourse/commit/958f0cd831d65a49ec75f05343ca2c167679f0ea
Patch
https://github.com/discourse/discourse/commit/aea35190791261bab258ebab05da279e78cdd0e6
Patch