CyberRota Analysis
AI-GeneratedPrior to the specified versions, regular users of the Discourse platform could exploit a vulnerability that allowed them to route direct S3 multipart uploads into the admin backup store, potentially compromising sensitive data. The impact of this issue is classified as medium, with a CVSS score of 6.5, indicating a moderate risk to data integrity and confidentiality. Organizations using affected versions should prioritize updating to the fixed releases to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)