CVE-2026-53961

6.5 Moyenne

Publiée le 10/07/2026 à 00:17 · Modifiée le 14/07/2026 à 22:37 · Analysée par le NVD · Source : security-advisories@github.com

Description

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish validly signed forged Bounce notifications that revoke a targeted user email. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Traduire en français

Produits concernés

discourse
Discourse discourse

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L`

Faiblesses (CWE)

CWE-345

Références

https://github.com/discourse/discourse/commit/3a3d315a85ef3c6aabfc7e7bb38702059784f06b Patch
https://github.com/discourse/discourse/commit/61f12e13aa1b760f81d5ff60f12e3a7e77434b94 Patch
https://github.com/discourse/discourse/commit/958f0cd831d65a49ec75f05343ca2c167679f0ea Patch
https://github.com/discourse/discourse/commit/aea35190791261bab258ebab05da279e78cdd0e6 Patch
https://github.com/discourse/discourse/releases/tag/v2026.1.5 Release Notes
https://github.com/discourse/discourse/releases/tag/v2026.4.2 Release Notes
https://github.com/discourse/discourse/releases/tag/v2026.5.1 Release Notes
https://github.com/discourse/discourse/releases/tag/v2026.6.0 Release Notes
https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories