Junglewise Threat Intelligence

CVE-2026-53961: Discourse insufficient verification in AWS SES bounce webhook

CVE-2026-53961 · Severity: medium · CVSS 6.5 · Published 2026-07-09

Technologies: Discourse. Vendors: Discourse.

Executive brief

Discourse is an open-source platform used for hosting online community discussions and forums. A vulnerability in how the platform handles email bounce notifications from Amazon Web Services (AWS) could allow an attacker to trick the system into thinking a user's email address is invalid. This results in the platform revoking the targeted user's email access, effectively preventing them from receiving forum notifications or resetting their passwords.

Technical details

A vulnerability exists in the Discourse AWS SES bounce webhook endpoint (`POST /webhooks/aws`) due to insufficient verification of data authenticity (CWE-345). While the application correctly verified that incoming Simple Notification Service (SNS) messages were cryptographically signed by Amazon, it failed to validate the `TopicArn` against an allowlist of trusted topics. An attacker with any valid AWS account could create their own SNS topic, subscribe the Discourse webhook to it, and send forged bounce notifications. This allows the attacker to increment the `bounce_score` for arbitrary email addresses, eventually leading to email revocation for targeted users. The fix introduces an `aws_sns_topic_arn_allowlist` setting and binds bounce processing to specific message and address identifiers.

Affected products

  • Discourse Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0

Timeline

  • 2026-06-30: patched: Fixes committed to various branches
  • 2026-07-09: disclosed: Public advisory published

References

Related threats