The vulnerability identified in this CVE is a missing authorization flaw in the ExternalUploadManager component of the Discourse discussion platform. It allows any authenticated regular user to route direct Amazon S3 multipart uploads into the admin backup store, giving them write access to a location that should be restricted to administrators. This flaw is classified under CWE‑862 and enables an attacker to place arbitrary files in a privileged storage area, which creates a potential privilege‑escalation pathway.

The affected product is Discourse, an open‑source discussion platform. Versions released prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 contain the flaw. The issue is fixed in those releases and in any later subsequent versions.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of <1% suggests a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. To exploit the flaw an attacker must have an authenticated user account and an ExternalUploadManager configured so uploads can be routed to the backup store. The user can trigger the upload via the web interface or API, enabling the unauthorized write. The combination of moderate severity and low exploitation likelihood indicates that timely patching is advised, but the overall threat surface is limited compared to higher‑impact vulnerabilities.