What is the CVSS score of CVE-2026-44784?

CVE-2026-44784 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44784?

Yes, a patch is available for CVE-2026-44784. Update the affected software to the latest version immediately.

Discourse CVE-2026-44784

EUVD-2026-36587 MEDIUM

Information Exposure (CWE-200)

2026-06-12 GitHub_M

Information Disclosure Discourse

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Requires authenticated group-owner session (PR:L) over the network; confidentiality-only impact as credentials are read from the log with no write or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 12, 2026 - 22:01 EUVD

Analysis Generated

Jun 12, 2026 - 21:34 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, group owners who are not necessarily admins or moderators can view a group's outgoing email/SMTP credentials in plaintext via the group history log (/groups/:name/logs.json). Affected fields: email_password, email_username, smtp_server, smtp_port, smtp_ssl_mode. The most sensitive item is the SMTP password, which an owner could use to send mail as the group from outside Discourse. This impacts sites that have configured per-group SMTP credentials and granted group ownership to users who should not have access to those credentials. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

AnalysisAI

Discourse group owners can retrieve plaintext SMTP credentials - including passwords, usernames, server, port, and SSL mode - from the group history log endpoint (/groups/:name/logs.json), affecting versions 2026.1.0-latest through pre-2026.1.4, 2026.3.0-latest through pre-2026.3.1, and 2026.4.0-latest through pre-2026.4.1. An authenticated group owner who holds no admin or moderator privileges can harvest the exposed SMTP password and use it to send mail impersonating the group's email identity from any external mail client, entirely bypassing Discourse's own sending controls. No public exploit code exists and this vulnerability is not listed in CISA KEV; the EPSS score of 0.03% at the 11th percentile reflects the narrow, configuration-dependent attack surface.

Technical ContextAI

Discourse is an open-source Ruby on Rails discussion platform that supports per-group SMTP configuration, allowing individual groups to send email through dedicated outbound mail accounts rather than the global Discourse mailer. The group history log feature records all administrative changes to group settings - including credential updates - and exposes them through the /groups/:name/logs.json endpoint. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause: the log endpoint returns unredacted credential fields (email_password, email_username, smtp_server, smtp_port, smtp_ssl_mode) to group owners without stripping or masking sensitive values. The access control gap exists because group owners are a distinct trust tier below admins and moderators, yet the log API did not enforce differential field visibility based on role. The CPE cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* covers all affected Discourse application instances regardless of hosting model.

RemediationAI

Upgrade Discourse to patched versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 as documented in vendor advisory GHSA-94c5-j24g-r99f (https://github.com/discourse/discourse/security/advisories/GHSA-94c5-j24g-r99f). After patching, rotate all per-group SMTP passwords immediately, as any group owner on an affected version may have already accessed the credentials through the history log. If immediate patching is not feasible, revoke group ownership from any user who should not have access to SMTP credentials - this eliminates access to the vulnerable endpoint without disrupting mail flow. Alternatively, restrict the per-group SMTP accounts at the mail server level to accept connections only from the Discourse server's IP address, limiting the blast radius if credentials are extracted; note this does not prevent credential disclosure but contains the credential's abuse potential. Disabling per-group SMTP entirely is the most aggressive workaround but will revert affected groups to the global mailer, disrupting group-specific email branding.