What is the CVSS score of CVE-2026-44780?

CVE-2026-44780 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44780?

Yes, a patch is available for CVE-2026-44780. Update the affected software to the latest version immediately.

Discourse CVE-2026-44780

EUVD-2026-36584 MEDIUM

Information Exposure (CWE-200)

2026-06-12 GitHub_M

Information Disclosure Discourse

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Category moderation group membership (PR:L) is required to reach the review queue; only bounded email metadata is exposed (C:L), with no write or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 12, 2026 - 22:01 EUVD

Analysis Generated

Jun 12, 2026 - 21:35 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, ReviewableQueuedPostSerializer unconditionally included payload["raw_email"] for posts that arrived via incoming email. Category moderation group members reaching the review queue could therefore read the full inbound email source (headers, sender trace, MUA, body) without being in view_raw_email_allowed_groups - the trust boundary that gates the dedicated raw-email endpoint. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

AnalysisAI

Discourse's ReviewableQueuedPostSerializer unconditionally exposes full inbound email source - including SMTP headers, sender trace, mail user agent, and body - to category moderation group members accessing the review queue, bypassing the view_raw_email_allowed_groups trust boundary that restricts the dedicated raw-email endpoint. Affected versions span the 2026.1.x, 2026.3.x, and 2026.4.x series on deployments using Discourse's incoming email feature. No public exploit has been identified and EPSS stands at 0.03% (9th percentile), indicating low automated exploitation probability, though the exposed data - including sender IP addresses and routing headers - presents meaningful privacy and de-anonymization risk to users who submitted posts via email.

Technical ContextAI

Discourse is an open-source Ruby on Rails-based discussion platform (CPE: cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*) that supports an email-in workflow allowing users to create posts by sending email to category-specific addresses. The ReviewableQueuedPostSerializer serializes queued post data for moderator review via the /review endpoint. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the serializer unconditionally included payload["raw_email"] when present on email-sourced posts, without evaluating the view_raw_email_allowed_groups ACL that normally gates the dedicated raw email inspection endpoint. This means the access control model for raw email viewing was enforced at the dedicated endpoint but not at the review queue serialization layer - a classic broken object-level authorization pattern where a secondary code path skips the intended permission check.

RemediationAI

Upgrade to one of the patched releases: Discourse 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1, all of which correct the ReviewableQueuedPostSerializer to enforce the view_raw_email_allowed_groups permission check before including raw email data in serialized output. The full vendor advisory is at https://github.com/discourse/discourse/security/advisories/GHSA-h2jr-whpx-6w63. Prior to patching, two compensating controls are available with noted trade-offs: first, restrict category moderation group membership exclusively to users who are already authorized in view_raw_email_allowed_groups - this eliminates the trust-boundary bypass but reduces the moderation workforce; second, disable incoming email processing for categories handling sensitive or privacy-sensitive submissions - this eliminates the vulnerable code path entirely but removes the email-in functionality for affected categories.