CVE-2026-46413: Discourse: Regular users can route multipart uploads into the admin backup store
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.6.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.4.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.1.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46413?
The severity of CVE-2026-46413 is rated as medium with a score of 6.5.
How do I fix CVE-2026-46413?
To fix CVE-2026-46413, upgrade Discourse to versions 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5.
What impact does CVE-2026-46413 have on Discourse?
CVE-2026-46413 allows regular users to route multipart uploads into the admin backup store, potentially compromising sensitive backup data.
Who is affected by CVE-2026-46413?
All installations of Discourse prior to version 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 are affected by CVE-2026-46413.
When was CVE-2026-46413 published?
CVE-2026-46413 was published on July 9, 2026.