Discourse verifies signatures on incoming AWS Simple Email Service bounce messages but fails to confirm that the message originates from a trusted Amazon SNS TopicArn. This missing binding allows any AWS account holder to create a correctly signed forged SNS message that Discourse accepts as a legitimate bounce, causing the platform to revoke a user’s email address. The flaw is a Missing Bindings weakness (CWE‑345) and results in denial of service to that user’s email channel, potentially hindering account recovery and notification delivery. No direct code execution or data exfiltration is possible through the vulnerability.

The open‑source discussion platform Discourse is affected in all releases prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. The issue is located in the AWS SES bounce webhook handler at the endpoint POST /webhooks/aws and is fixed in the mentioned releases.

The CVSS score of 6.5 places the vulnerability at medium severity, and the EPSS score of <1% indicates a low probability of widespread exploitation. Because the vulnerability is not listed in the CISA KEV catalog, it is not known to be actively targeted. The likely attack vector is inbound; an attacker who controls an AWS account can generate a properly signed forged SNS notification and send it to the vulnerable webhook, leading to email revocation for a chosen user. While exploitation requires only an AWS account and knowledge of the Discourse webhook endpoint, it can disrupt user accounts or facilitate further compromise by denying legitimate email communication.