Vulnerability Report

CVE-2026-53961

Title: AWS SES bounce webhook bypass in Discourse

Other

Proof Of Concept

No public PoC currently indexed for CVE-2026-53961.

CWE Category CWE-345

Published Date Jul 09, 2026

Modified Date Jul 14, 2026

Exploit Status Not Found

Score 6.5 CVSS v3.1

Exploit Probability (EPSS)

0.22%

Vulnerability Summary

CVE-2026-53961: Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish validly signed forged Bounce notifications that revoke a targeted user email. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Impacted Vendors

discourse 1

Reference Links

https://github.com/discourse/discourse/commit/3a3d315a85ef3c6aabfc7e7bb38702059784f06b https://github.com/discourse/discourse/commit/61f12e13aa1b760f81d5ff60f12e3a7e77434b94 https://github.com/discourse/discourse/commit/958f0cd831d65a49ec75f05343ca2c167679f0ea https://github.com/discourse/discourse/commit/aea35190791261bab258ebab05da279e78cdd0e6 https://github.com/discourse/discourse/releases/tag/v2026.1.5 https://github.com/discourse/discourse/releases/tag/v2026.4.2 https://github.com/discourse/discourse/releases/tag/v2026.5.1 https://github.com/discourse/discourse/releases/tag/v2026.6.0 https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

6.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-53961 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

July 14, 2026 MODIFIED

Vulnerability data updated via NVD.

July 10, 2026 MODIFIED

Vulnerability data updated via NVD.

July 09, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected Stack

No specific products linked.