CVE-2026-46413
- Source
- https://cve.org/CVERecord?id=CVE-2026-46413
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46413.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-46413
- Aliases
-
- BIT-discourse-2026-46413
- GHSA-3mvf-q9rg-w6m7
- Published
- 2026-07-09T21:55:45Z
- Modified
- 2026-08-12T03:51:09Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- Discourse: Regular users can route multipart uploads into the admin backup store
- Details
-
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-862" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46413.json" }- References
-
- https://github.com/discourse/discourse/releases/tag/v2026.1.5
- https://github.com/discourse/discourse/releases/tag/v2026.4.2
- https://github.com/discourse/discourse/releases/tag/v2026.5.1
- https://github.com/discourse/discourse/releases/tag/v2026.6.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46413.json
- https://github.com/discourse/discourse/security/advisories/GHSA-3mvf-q9rg-w6m7
- https://nvd.nist.gov/vuln/detail/CVE-2026-46413
- https://github.com/discourse/discourse/commit/1f1ded8dd361d81786bff17b35e1138d6ee299c0
- https://github.com/discourse/discourse/commit/7ddde266617b452152c1bf5f903f6c07be38fc40
- https://github.com/discourse/discourse/commit/a53df26dcf7e50ce2b20bfd5454a0c9d44b8fc7d
- https://github.com/discourse/discourse/commit/abaa664c5df84026efb2ca264ba0f5586c3f2b01
Affected packages
Git / github.com/discourse/discourse
Affected ranges
- Type
- GIT
- Repo
- https://github.com/discourse/discourse
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "cpe": [ "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*", "cpe:2.3:a:discourse:discourse:2026.6.0:*:*:*:latest:*:*:*" ], "extracted_events": [ { "introduced": "2026.1.0" }, { "fixed": "2026.1.5" }, { "introduced": "2026.4.0" }, { "fixed": "2026.4.2" }, { "introduced": "2026.5.0" }, { "fixed": "2026.5.1" }, { "introduced": "2026.6.0" }, { "last_affected": "2026.6.0" } ], "source": [ "CPE_RANGE", "CPE_STRING", "REFERENCES" ] }