CVE-2026-44780: 
NixOS vulnerability analysis and mitigation

CVE-2026-44780 is an information disclosure vulnerability in Discourse, the open-source discussion platform, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw affects versions 2026.1.0-latest through before 2026.1.4, 2026.3.0-latest through before 2026.3.1, and 2026.4.0-latest through before 2026.4.1. It was published on June 12, 2026, and originally disclosed by GitHub user davidtaylorhq on May 18, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory).

The root cause is that ReviewableQueuedPostSerializer unconditionally included payload["raw_email"] in its output for posts that arrived via incoming email, without checking whether the requesting user belonged to view_raw_email_allowed_groups — the designated trust boundary controlling access to raw email content (CWE-200). Any authenticated user who is a member of a category moderation group and has access to the review queue could exploit this by simply navigating to the review queue and reading the serialized post payload, which would contain the full inbound email source including headers, sender trace, mail user agent (MUA), and body. No special tools or elevated privileges beyond category moderator membership are required. The patch corrects this by gating the raw_email field in the serializer behind a Guardian#can_view_raw_emails? check and hiding the envelope icon affordance in the frontend for unauthorized users (GitHub Advisory).

Successful exploitation allows category moderation group members to read the full raw inbound email source — including SMTP headers, sender routing trace, mail client (MUA) information, and message body — for any queued post that originated from an incoming email. This constitutes an unauthorized confidentiality breach, potentially exposing sender identity, internal email infrastructure details, and private message content that the sender did not intend to share with category moderators. There is no integrity or availability impact, and lateral movement potential is limited; however, exposed email metadata could facilitate social engineering or targeted phishing against email senders (GitHub Advisory).

1. Identify a vulnerable Discourse instance: Confirm the target is running Discourse versions 2026.1.0–2026.1.3, 2026.3.0, or 2026.4.0, which include the unpatched ReviewableQueuedPostSerializer.
2. Obtain category moderator access: Log in as a user who is a member of a category moderation group on the target Discourse instance (or compromise such an account).
3. Navigate to the review queue: Access the Discourse review queue (typically at /review) where queued posts pending moderation are listed.
4. Identify email-originated posts: Look for queued posts that arrived via incoming email — these will have raw_email data embedded in the serialized payload.
5. Extract raw email data: Inspect the API response or page source for the review queue entries; the raw_email field will be present in the JSON payload, containing full email headers, sender trace, MUA, and body without any authorization check (GitHub Advisory).

• Logs: Discourse application logs showing repeated or unusual access to the /review endpoint by users who are category moderators but not members of view_raw_email_allowed_groups.
• Network: API responses to /review.json or related review queue endpoints containing raw_email fields with full email source data being transmitted to unauthorized clients.
• Application Behavior: Users in category moderation groups accessing the review queue for email-originated posts at an unusually high frequency, potentially indicating automated scraping of raw email data.

Discourse has released patched versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1, which redact raw_email from the serialized payload unless the requesting user is in view_raw_email_allowed_groups. No configuration-based workaround is available; upgrading to a patched version is the only recommended remediation. Administrators should also audit membership of category moderation groups to ensure only trusted users have access to the review queue (GitHub Advisory).