What is the CVSS score of CVE-2026-46413?

CVE-2026-46413 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-46413?

Yes, a patch is available for CVE-2026-46413. Update the affected software to the latest version immediately.

Discourse CVE-2026-46413

EUVD-2026-42729 MEDIUM

Missing Authorization (CWE-862)

2026-07-09 security-advisories@github.com

Authentication Bypass Discourse

6.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-exploitable web app requiring only a low-privilege account; write-only impact to admin storage with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:42 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

AnalysisAI

Unauthorized write access to the admin backup store in Discourse allows any authenticated regular user to route S3 multipart uploads into a storage area that should be restricted to administrators. The flaw exists in ExternalUploadManager, which fails to enforce authorization checks (CWE-862) when accepting direct S3 multipart upload requests, meaning a low-privilege account holder can target the admin backup destination path without restriction. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis, but the low attack complexity and network accessibility make this a credible threat on any Discourse deployment using S3 direct uploads.

Technical ContextAI

Discourse is an open-source Ruby on Rails-based discussion platform that supports Amazon S3 as an external storage backend. The ExternalUploadManager component handles direct-to-S3 multipart upload flows, where clients upload file parts directly to S3 rather than routing through the Discourse server. The admin backup store is a privileged S3 prefix or bucket used to store Discourse database and file backups, normally restricted to administrator-initiated operations. CWE-862 (Missing Authorization) identifies the root cause: the server-side code that processes multipart upload completions via ExternalUploadManager does not verify whether the requesting user has the authorization level required to write to the admin backup store destination, allowing the access control boundary between regular users and admin storage to be bypassed at the S3 object routing layer.

RemediationAI

Vendor-released patches are confirmed at versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, available at github.com/discourse/discourse/releases. Administrators should upgrade to the appropriate patched release for their branch as the primary remediation. The four fix commits (1f1ded8, 7ddde26, a53df26, abaa664) on the main GitHub repository can be reviewed for context. If immediate upgrade is not possible, a compensating control would be to restrict S3 direct upload functionality at the network or IAM policy level - specifically, deny the S3 bucket policy permissions that allow the Discourse application role to write to the backup prefix from non-admin-initiated sessions. This trade-off introduces operational friction for legitimate large-file uploads. Restricting new user registrations or requiring email approval for accounts reduces the pool of potential low-privilege attackers on public forums but does not eliminate risk from existing regular accounts. The GitHub Security Advisory is available at github.com/discourse/discourse/security/advisories/GHSA-3mvf-q9rg-w6m7.