Login Request a demo
Medium severity · published Jul 9, 2026
CVE-2026-53961
Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish validly signed forged Bounce notifications that revoke a targeted user email. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
discourse · discourse
>= 2026.5.0-latest, < 2026.5.1; >= 2026.4.0-latest, < 2026.4.2; >= 2026.1.0-latest, < 2026.1.5 · source: vendor, NVD
Affected product
DI
discourse
discourse
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53961
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53961
Patch
https://github.com/discourse/discourse/commit/3a3d315a85ef3c6aabfc7e7bb38702059784f06b
Patch
https://github.com/discourse/discourse/commit/61f12e13aa1b760f81d5ff60f12e3a7e77434b94
Patch
https://github.com/discourse/discourse/commit/958f0cd831d65a49ec75f05343ca2c167679f0ea
Patch
https://github.com/discourse/discourse/commit/aea35190791261bab258ebab05da279e78cdd0e6
Release Notes
https://github.com/discourse/discourse/releases/tag/v2026.1.5
Release Notes
https://github.com/discourse/discourse/releases/tag/v2026.4.2
More from discourse
9.9
CVE-2025-68662
FinalDestination hostname matching allows SSRF protection bypass
9.8
CVE-2025-53102
Discourse's WebAuthn challenge isn't cleared from user session after authentication
9.8
CVE-2025-48877
Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe
9.8
CVE-2023-47121
Discourse is an open source platform for community discussion
9.8
CVE-2021-41163
Discourse is an open source platform for community discussion