CVE-2026-46413

Katalog CVE

CVSS 6.5 · Medium EPSS 0,51%

Kerentanan Missing Authorization pada discourse. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Rincian

Terbit di NVD

9 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 42,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-3mvf-q9rg-w6m7 advisory vendor · mitigasi
• https://github.com/discourse/discourse/commit/1f1ded8dd361d81786bff17b35e1138d6ee299c0 patch
• https://github.com/discourse/discourse/commit/7ddde266617b452152c1bf5f903f6c07be38fc40 patch
• https://github.com/discourse/discourse/commit/a53df26dcf7e50ce2b20bfd5454a0c9d44b8fc7d patch
• https://github.com/discourse/discourse/commit/abaa664c5df84026efb2ca264ba0f5586c3f2b01 patch
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 release notes
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 release notes
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 release notes
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 release notes