Discourse EUVD-2026-42728

Exploitation requires that the target Discourse instance has the AWS SES bounce webhook integration enabled and the POST /webhooks/aws endpoint reachable over the network. The attacker must hold a valid AWS account (freely obtainable) to publish SNS messages signed by Amazon - no Discourse account or credentials are required. The attacker must also know a valid email address registered to a target user on the instance. Exploitation is limited to one email revocation per attack invocation; mass revocation would require repeated targeted requests per victim. Discourse instances using any other email provider (SMTP without SES, Mailgun, Postmark, etc.) or with the SES webhook not configured are completely unaffected. No special platform version, OS, or deployment topology beyond SES integration enablement is required.

The NVD CVSS 6.5 with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L accurately characterizes the attack surface: the webhook is internet-facing, no Discourse credentials are required, and no user interaction is needed. However, the 'PR:N' metric warrants context - while no Discourse authentication is required, the attacker must possess a valid AWS account to publish SNS messages. AWS accounts are freely and cheaply obtainable, so this is not a meaningful barrier in practice, but it does distinguish the attack from a fully anonymous internet threat. No EPSS data was provided in the intelligence feed; given the absence of KEV listing and no public exploit code, exploitation probability appears low at this time. Real-world impact is limited to targeted disruption: each attack revokes a single victim's email association, which can lock them out of email-based account recovery or disable forum notifications - a denial-of-email-service or harassment vector rather than a credential-theft or RCE scenario. The 'Information Disclosure' tag applied by the reporter appears misaligned; the actual impact is integrity and availability, not data exfiltration. Deployments not using the AWS SES integration are entirely unaffected, significantly narrowing the real-world exposed population.

An attacker registers or uses an existing AWS account, creates an SNS topic, and constructs a valid SNS Bounce notification JSON payload targeting a known Discourse user's email address. Publishing this message through Amazon's SNS infrastructure causes Amazon to sign it with valid Amazon credentials; the attacker then delivers it to the victim Discourse instance's POST /webhooks/aws endpoint. Discourse's signature verification passes, the platform treats the notification as a legitimate SES bounce, and the target user's email address is revoked. No public exploit code exists at time of analysis.