CVE-2026-46413

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-46413
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46413.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-46413
Aliases
  • GHSA-3mvf-q9rg-w6m7
Published
2026-07-09T21:55:45.096Z
Modified
2026-07-15T01:49:18.899169604Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Discourse: Regular users can route multipart uploads into the admin backup store
Details

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46413.json",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Introduced
fdd750d960e603415db62242eca3c30d68e366db
Introduced
640840d818f4ee9375829ece0ef452923bb0c012
Fixed
c06899647d758493d95a5b301e573ffa3db1e878
Fixed
4bbdddfc6700ca23604242111d4fa0e00347af97
Fixed
598586ccf2e046a25d4b54132e4e1feb47f24e98
Fixed
1f1ded8dd361d81786bff17b35e1138d6ee299c0
Fixed
7ddde266617b452152c1bf5f903f6c07be38fc40
Fixed
a53df26dcf7e50ce2b20bfd5454a0c9d44b8fc7d
Fixed
abaa664c5df84026efb2ca264ba0f5586c3f2b01
Fixed
06d03da34c4ed09ea59f917f045ba250d2b6320d
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2026.1.0-latest"
        },
        {
            "fixed": "2026.1.5"
        },
        {
            "introduced": "2026.4.0-latest"
        },
        {
            "fixed": "2026.4.2"
        },
        {
            "introduced": "2026.5.0-latest"
        },
        {
            "fixed": "2026.5.1"
        }
    ]
}

Affected versions

Other
esr
stable
v2026.*
v2026.1.0
v2026.1.0-latest
v2026.1.1
v2026.1.2
v2026.1.3
v2026.1.4
v2026.4.0
v2026.4.0-latest
v2026.4.1
v2026.5.0
v2026.5.0-latest
v2026.5.0-latest.1
v2026.6.0-latest

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46413.json"