BIT-discourse-2026-46413

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/discourse/BIT-discourse-2026-46413.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-discourse-2026-46413

Aliases

CVE-2026-46413
GHSA-3mvf-q9rg-w6m7

Published

2026-07-15T15:56:17Z

Modified

2026-09-08T08:46:23Z

Summary

Discourse: Regular users can route multipart uploads into the admin backup store

Details

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Database specific

{
    "cpes": [
        "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / discourse

Package

Name: discourse
Purl: pkg:bitnami/discourse

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

2026.1.0

Fixed

2026.1.5

Introduced

2026.4.0

Fixed

2026.4.2

Introduced

2026.5.0

Fixed

2026.5.1

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/discourse/BIT-discourse-2026-46413.json"