CVE-2026-44780CWE-200

Discourse: Category queue reviewers can read raw incoming emails from queued posts

Medium · published June 12, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, ReviewableQueuedPostSerializer unconditionally included payload["raw_email"] for posts that arrived via incoming email. Category moderation group members reaching the review queue could therefore read the full inbound email source (headers, sender trace, MUA, body) without being in view_raw_email_allowed_groups — the trust boundary that gates the dedicated raw-email endpoint. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00319 · 23.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-06-12T20:22Z
EPSS history
Timeline
  • 12 JUN 20:22Z
    Discourse: Category queue reviewers can read raw incoming emails from queued posts
    cvelistv5