CVE-2026-53961

Katalog CVE

CVSS 6.5 · Medium EPSS 0,30%

Kerentanan Insufficient Verification of Data Authenticity pada discourse. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish validly signed forged Bounce notifications that revoke a targeted user email. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Rincian

Terbit di NVD

9 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 21,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x advisory vendor
• https://github.com/discourse/discourse/commit/3a3d315a85ef3c6aabfc7e7bb38702059784f06b patch
• https://github.com/discourse/discourse/commit/61f12e13aa1b760f81d5ff60f12e3a7e77434b94 patch
• https://github.com/discourse/discourse/commit/958f0cd831d65a49ec75f05343ca2c167679f0ea patch
• https://github.com/discourse/discourse/commit/aea35190791261bab258ebab05da279e78cdd0e6 patch
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 release notes
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 release notes
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 release notes
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 release notes