CVE-2026-44780: Discourse Email Information Disclosure via Category Moderation Queue

Technical summary

The ReviewableQueuedPostSerializer in Discourse versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0 unconditionally includes the raw_email field in the serialized payload when posts originate from incoming email. Category moderation group members—who have review queue access—can therefore retrieve the unfiltered email source without membership in view_raw_email_allowed_groups, the trust boundary protecting the dedicated raw-email API endpoint. This represents an information disclosure flaw (CWE-200) due to improper output filtering in the review queue serializer.

Business impact

Organizations using Discourse for team collaboration, customer support channels, or community management may inadvertently expose email metadata and content to a broader group of moderators than policy allows. This could reveal customer PII, internal correspondence, email client/server information, authentication tokens in headers, or other sensitive data embedded in inbound mail. Compliance frameworks (GDPR, HIPAA, SOC 2) may require tighter controls over who can access raw email; this vulnerability weakens that boundary and could trigger audit findings or remediation mandates.

Affected systems

Discourse installations using the incoming email feature are at risk if they rely on view_raw_email_allowed_groups to gate access to email source material. Affected version ranges: 2026.1.0–2026.1.3, 2026.3.0–2026.3.0, and 2026.4.0–2026.4.0. Patched versions: 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1. Instances without incoming email integration are unaffected.

Exploitability

Exploitability is straightforward for authenticated actors. An attacker with category moderation privileges (a role many organizations grant liberally) can navigate the review queue and inspect email metadata and content for any posts flagged for review. No network positioning, authentication bypass, or user interaction is required beyond normal forum access. The CVSS 3.1 score of 4.3 reflects this: low attack vector (network), low complexity, and requirement for authenticated login—but the impact is confined to information disclosure without integrity or availability effects.

Remediation

Apply security updates immediately: upgrade to 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 (or later stable versions). The patch restricts raw_email inclusion in the ReviewableQueuedPostSerializer to only those users in view_raw_email_allowed_groups. After patching, validate that moderation group membership aligns with your organization's data-access policies.

Patch guidance

Verify the exact patched versions against the official Discourse advisory and your instance's version string (Settings > Admin > System). Update via package manager or Docker image if self-hosted. Verify the patch in a staging environment before production deployment. Monitor Discourse release notes for any rollout issues. If you cannot patch immediately, consider temporarily restricting category moderation group membership to users who have legitimate need to view raw email.

Detection guidance

Review audit logs for category moderation group members accessing the review queue, particularly around email-sourced posts, between your instance's deployment date and the patched version. Check Discourse logs (e.g., /var/discourse/shared/log/ in Docker) for API calls to review queue endpoints by moderators not in view_raw_email_allowed_groups. Correlate review queue access with posts tagged as incoming email. No known public exploit code exists; detection relies on access pattern analysis and version identification.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), the vulnerability merits swift patching because: (1) it defeats a named access-control boundary (view_raw_email_allowed_groups), (2) email metadata often contains PII or authentication tokens that should be restricted, (3) many organizations grant moderation roles broadly, expanding the exposure, and (4) the patch is straightforward and available. Organizations in regulated industries or handling customer email should prioritize this within their standard patch cycle.

Risk score, explained

CVSS 3.1 assigns a score of 4.3 (MEDIUM severity) under the vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The score reflects a network-accessible, low-complexity attack requiring authenticated login (PR:L) with no user interaction, limited to confidentiality impact (C:L) and no scope change. While the absolute score is moderate, the nature of the leak—unguarded access to email source—makes it material in trust and compliance contexts.

Frequently asked questions