Vulnerability in Discourse

CVE-2026-53961

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish validly signed forged Bounce notifications that revoke a targeted user email. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

EPSS exploit prediction

EPSS: 0.003 (20.8th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 21st percentile — 20.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-53961: held from 0.003 to 0.003.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

  • Discourse — versions >= 2026.5.0-latest, < 2026.5.1, >= 2026.4.0-latest, < 2026.4.2, 2026.6.0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-53961?
CVE-2026-53961 is a medium-severity vulnerability in Discourse, classified under Insufficient Verification of Data Authenticity. CVSS score: 6.5/10. Published 2026-07-09.
How severe is CVE-2026-53961?
Medium severity. CVSS v3 base score is 6.5 out of 10.