PT-2026-56998 · Discourse · Discourse

CVE-2026-53961

·

Published

2026-07-09

·

Updated

2026-07-15

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.6.0 Discourse versions prior to 2026.5.1 Discourse versions prior to 2026.4.2 Discourse versions prior to 2026.1.5
Description The AWS SES bounce webhook at the endpoint "POST /webhooks/aws" verifies that SNS messages are signed by Amazon but fails to bind them to trusted TopicArn values. This allows any AWS account holder to publish validly signed forged Bounce notifications, which can be used to revoke a targeted user email.
Recommendations Update to version 2026.6.0. Update to version 2026.5.1. Update to version 2026.4.2. Update to version 2026.1.5.

Exploit

Fix

Insufficient Verification of Data Authenticity

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-345

Related Identifiers

BIT-DISCOURSE-2026-53961
CVE-2026-53961
GHSA-8F9M-V436-WR3X

Affected Products

Discourse