Discourse CVE-2026-44784

Exploitation requires all of the following specific conditions to be simultaneously true: (1) the Discourse instance must have per-group SMTP credentials explicitly configured on at least one group - this is a non-default feature requiring deliberate administrator setup, and sites using only the global mailer are entirely unaffected; (2) the attacker must hold an authenticated Discourse session with group owner role on the targeted group - unauthenticated users and members without owner role cannot access the logs endpoint; (3) the group owner must not also be an admin or moderator, as the vulnerability is specifically scoped to the trust gap in the owner tier. The primary limiting factor is the non-default per-group SMTP configuration, which reduces the total vulnerable population significantly. Exploitation is further constrained to the history log entries that captured credential changes - groups whose SMTP settings have never been modified after initial setup may have fewer or no log entries exposing credentials.

The vendor-assigned CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately represents the risk profile: network-reachable with low attack complexity, but requiring authenticated access at the group-owner privilege level. The high confidentiality impact is justified by the exposure of reusable SMTP credentials that grant persistent, out-of-band email relay capability. However, the EPSS score of 0.03% at the 11th percentile strongly signals low observed exploitation interest, consistent with the narrow precondition set. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, making this a low-urgency but concrete risk for the subset of Discourse deployments using per-group SMTP with non-admin group owners. The real-world threat is insider-threat or trust-boundary abuse: a legitimately provisioned group owner exploiting the credential exposure to conduct phishing or spam campaigns that impersonate a trusted organizational email identity. Sites using only the global Discourse mailer face zero exposure. No conflicting signals exist in the available data.

An authenticated Discourse user who has been granted group ownership - without admin or moderator status - issues a GET request to /groups/:name/logs.json for a group they own that has per-group SMTP configured. The JSON response includes the plaintext SMTP password alongside server address and port, which the attacker then enters into an external SMTP client (e.g., a scripted curl command or a mail relay tool) to send emails from the group's address to targets outside Discourse, enabling phishing or spam campaigns that abuse the group's trusted sender identity. No exploit code is publicly available and exploitation has not been confirmed in the wild.