Executive brief
Discourse is an open-source platform used for hosting online discussion forums and communities. A security flaw allows users who manage specific groups to view sensitive email server credentials, including passwords, in plain text. An unauthorized person could use these credentials to send emails appearing to come from the organization, potentially leading to phishing attacks or damage to the organization's reputation.
Technical details
An information disclosure vulnerability exists in Discourse where group owners (who may not have administrative or moderator privileges) can access sensitive SMTP configuration details. The vulnerability is located in the group history log endpoint (/groups/:name/logs.json), which exposes fields such as email_password, email_username, and smtp_server in plaintext. An attacker with group owner privileges can exploit this to obtain credentials and send emails from the group's account outside of the Discourse platform. The issue affects sites using per-group SMTP credentials and has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected products
- Discourse Discourse 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, 2026.4.0-latest to before 2026.4.1
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: NVD publication date