CVE-2026-53961

MEDIUM 6.5

Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)

CVSS Score

6.5

EPSS Score

0.2%

EPSS Percentile

13th

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish validly signed forged Bounce notifications that revoke a targeted user email. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

CWE	CWE-345
Vendor	discourse
Product	discourse
Published	Jul 9, 2026
Last Updated	Jul 10, 2026

Stay Ahead of the Next One

Get instant alerts for discourse discourse

Be the first to know when new medium vulnerabilities affecting discourse discourse are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Affected Versions

discourse / discourse

>= 2026.5.0-latest, < 2026.5.1 >= 2026.4.0-latest, < 2026.4.2 >= 2026.1.0-latest, < 2026.1.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗