CVE-2026-44780: Discourse: Category queue reviewers can read raw incoming emails from queued posts
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, ReviewableQueuedPostSerializer unconditionally included payload["rawemail"] for posts that arrived via incoming email. Category moderation group members reaching the review queue could therefore read the full inbound email source (headers, sender trace, MUA, body) without being in viewrawemailallowedgroups — the trust boundary that gates the dedicated raw-email endpoint. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.4 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.4.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.5.0-latest.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44780?
The severity of CVE-2026-44780 is rated as medium, with a score of 4.3.
What risks are associated with CVE-2026-44780?
CVE-2026-44780 poses a risk of information leakage, allowing category queue reviewers to access raw incoming emails from queued posts.
How do I fix CVE-2026-44780?
To fix CVE-2026-44780, update Discourse to version 2026.1.4, 2026.3.1, or 2026.4.1 or later.
Which versions of Discourse are affected by CVE-2026-44780?
CVE-2026-44780 affects Discourse versions 2026.1.0 to below 2026.1.4, 2026.3.0 to below 2026.3.1, and 2026.4.0 to below 2026.4.1.
What type of vulnerability is CVE-2026-44780 classified as?
CVE-2026-44780 is classified as an information leakage vulnerability.