CVE-2026-44784: Discourse SMTP Credential Exposure via Group History Logs

Technical summary

The vulnerability stems from insufficient access controls in Discourse's group history logging feature. When per-group SMTP credentials are configured, sensitive fields including email_password, email_username, smtp_server, smtp_port, and smtp_ssl_mode are exposed via the /groups/:name/logs.json endpoint without proper authorization checks. Group owners—a role distinct from admin or moderator—can access this endpoint and retrieve credentials in plaintext. An authenticated group owner could extract the SMTP password and use it to authenticate against the configured mail server independently of Discourse, enabling email spoofing or unauthorized mail relay. The attack requires only network access and valid group ownership status.

Business impact

Exposure of SMTP credentials creates a direct channel for email compromise. Attackers with group owner access can send mail as the group, potentially conducting phishing campaigns, business email compromise, or reputation damage by sending malicious messages that appear to originate from trusted group accounts. For organizations using per-group SMTP to isolate email infrastructure by department or function, this breaks that isolation boundary. If group ownership has been delegated to non-admin users for community management purposes, those users now have unintended access to email infrastructure. Downstream reputation and deliverability issues may follow if the compromised credentials are used for spam or malware distribution.

Affected systems

Discourse versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0 are affected. Patched versions are 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1. Only Discourse installations with per-group SMTP credentials configured are vulnerable; default deployments using a single mail server are not impacted. The risk scales with the number of groups assigned to non-admin users and the sensitivity of email infrastructure those groups control.

Exploitability

Exploitability is straightforward. An attacker must be authenticated to the Discourse instance and hold group owner status—roles that may be granted liberally for community management. No additional user interaction, special network position, or authentication bypass is required. The /groups/:name/logs.json endpoint is typically accessible from any network location where the Discourse instance is reachable. The CVSS score of 6.5 (Medium) reflects the requirement for prior authentication and the confidentiality-only impact, but organizations should weight this against the high value of email credentials in their threat model.

Remediation

Update Discourse to a patched version: 2026.1.4 or later for the 2026.1 branch, 2026.3.1 or later for the 2026.3 branch, 2026.4.1 or later for the 2026.4 branch, or any version of 2026.5.0-latest with patch level 2026.5.0-latest.1 or higher. After patching, audit all group ownership assignments, particularly in instances where per-group SMTP is in use. Consider restricting group owner privileges to individuals who have demonstrated need for community management responsibility, and evaluate whether per-group SMTP credentials remain necessary or if centralized email infrastructure would reduce operational risk.

Patch guidance

Discourse maintainers have released patches for all affected version branches. Organizations should prioritize patching in the following order: systems with per-group SMTP configured and group ownership assigned to non-admin users; then general updates across all Discourse deployments, as the fix is safe and does not alter the group history logging feature—it only restricts unauthorized access. Apply patches during a maintenance window and test that group owners can still access non-sensitive history logs and perform expected management functions. No manual configuration changes are required post-patch.

Detection guidance

Review Discourse logs and audit access patterns to /groups/:name/logs.json for the past 90 days. Identify if any group owner accounts (confirmed via group_owners table or equivalent) accessed the logs endpoint. Cross-reference IP addresses and user agents with known administrative activity to distinguish routine use from potential compromise. If per-group SMTP credentials are stored, rotate SMTP passwords immediately as a precaution. Monitor SMTP relay logs for authentication from IP addresses or times inconsistent with known Discourse server behavior. Correlation between group owner login times and anomalous SMTP relay activity may indicate active exploitation.

Why prioritize this

This vulnerability should be prioritized if your Discourse installation uses per-group SMTP and has delegated group ownership to non-admin users. The exposure of email credentials is a high-confidence attack vector with direct business impact, and the fix is mature and low-risk. If Discourse uses only a single centralized mail server (the common case), risk is lower but patching remains recommended for defense-in-depth.

Risk score, explained

The CVSS 6.5 (Medium) reflects confidentiality impact only (no integrity or availability loss) and the authentication requirement. However, the true risk depends on organizational context: if per-group SMTP is not in use, the risk is negligible; if it is in use and owns sensitive outbound email infrastructure, the risk exceeds the base score because email credentials are a high-value asset. The public nature of the vulnerability and ready availability of patched versions mean that unmaintained instances are at elevated risk.

Frequently asked questions