Executive brief
Discourse is an open-source platform used for hosting online discussion forums and communities. A security flaw allowed forum moderators to view the full technical source of incoming emails, including headers and sender metadata, even if they did not have the specific permissions required to see such sensitive data. This could lead to the exposure of private sender information or internal technical details to unauthorized staff members.
Technical details
The vulnerability is classified as an Information Exposure (CWE-200) within the Discourse review queue system. Specifically, the 'ReviewableQueuedPostSerializer' component failed to validate user permissions before including the 'raw_email' payload in API responses for posts submitted via email. This allowed users with category moderation privileges to bypass the 'view_raw_email_allowed_groups' restriction and access full email headers, sender traces, and Mail User Agent (MUA) details. The attack requires low-level authenticated access (moderator status) and is reachable over the network. The fix involves redacting the 'raw_email' field in the serializer unless the user meets the specific group requirements and updating the frontend to hide associated UI elements. Patches are available in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected products
- Discourse Discourse 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, 2026.4.0-latest to before 2026.4.1
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD