What is the CVSS score of CVE-2026-53961?

CVE-2026-53961 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-53961?

Yes, a patch is available for CVE-2026-53961. Update the affected software to the latest version immediately.

Discourse CVE-2026-53961

EUVD-2026-42728 MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2026-07-09 security-advisories@github.com

Information Disclosure Discourse

6.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Webhook is network-accessible with no Discourse authentication required (PR:N, AV:N); AWS account prerequisite is attacker-controlled, not a target-side access control (AC:L); impact confined to email revocation with no confidentiality loss (I:L, A:L, C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:44 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish validly signed forged Bounce notifications that revoke a targeted user email. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

AnalysisAI

Discourse's AWS SES bounce webhook endpoint (POST /webhooks/aws) validates Amazon SNS message signatures but omits TopicArn binding, allowing any AWS account holder to publish legitimately signed forged Bounce notifications that revoke a targeted Discourse user's email address. Versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 across all active release branches are affected when the SES integration is enabled. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low attack complexity and absence of Discourse-side authentication requirements make targeted abuse realistic for any motivated actor with an AWS account.

Technical ContextAI

Discourse integrates with Amazon Simple Email Service (SES) through Amazon SNS webhook callbacks to process bounce and complaint notifications. The vulnerable endpoint (POST /webhooks/aws) performs cryptographic verification that each incoming SNS message carries a valid Amazon signature - confirming the message transited Amazon's own infrastructure - but fails to validate the SNS TopicArn against a trusted allowlist configured by the Discourse operator. This is a textbook CWE-345 (Insufficient Verification of Data Authenticity) defect: the authentication check proves the carrier is Amazon but does not prove the sender is the operator's own SNS topic. Because any AWS account can create an SNS topic and publish messages that Amazon will sign, the signature check is rendered meaningless as an authorization control. The root fix, visible across four GitHub commits (3a3d315, 61f12e1, 958f0cd, aea3519), introduces TopicArn binding so only notifications from the operator's configured topic are accepted.

RemediationAI

Upgrade Discourse to 2026.6.0 (stable), 2026.5.1 (beta), 2026.4.2 (tests-passed), or 2026.1.5 (legacy), per the operator's active release branch. All four versions contain the TopicArn binding fix as confirmed by GitHub release tags and four associated commits. If immediate patching is not feasible, the most targeted workaround is to disable the AWS SES bounce webhook integration entirely, which removes the vulnerable endpoint from the attack surface at the cost of losing automated bounce processing - operators would need to handle hard bounces manually or via an alternative mechanism. A secondary compensating control is to restrict network access to POST /webhooks/aws using a reverse-proxy or WAF rule to Amazon SNS IP ranges published at https://ip-ranges.amazonaws.com/ip-ranges.json; note that this does not eliminate the underlying TopicArn validation gap, since a forged message from any AWS account would still originate from Amazon-owned IP ranges and carry a valid Amazon signature.