Discourse EUVD-2026-36584

Exploitation requires an authenticated Discourse user who holds membership in at least one category moderation group (PR:L). The vulnerability is only triggered for posts that entered the review queue via Discourse's incoming email feature (email-in must be enabled and the category must be configured to receive email). The attacker must access the review queue endpoint while posts from an email-enabled category are pending review. Exploitation is meaningfully limited by: the requirement for category moderation group membership (not granted to general users), the dependency on the incoming email feature being active, the need for email-sourced posts to be present in the queue at the time of access, and the read-only nature of the flaw (no integrity or availability impact). Discourse instances that do not use incoming email processing are entirely unaffected.

The vendor-assigned CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately reflects the real-world risk profile. PR:L correctly requires category moderation group membership - a non-trivial but low-friction prerequisite on active forums. The confidentiality impact is bounded (C:L): exposure is limited to email metadata and content for posts in the review queue, not credentials, session tokens, or system data. EPSS at 0.03% (9th percentile) strongly suggests this vulnerability has not been incorporated into automated attack tooling, and the absence of a CISA KEV listing and any identified POC corroborates that. The primary realistic harm is privacy erosion: email headers routinely contain sender IP addresses, internal mail relay paths, and MUA fingerprints that can de-anonymize users who expected privacy when submitting via email. For privacy-sensitive deployments (whistleblower communities, activist forums), this is a meaningful risk despite the moderate CVSS score. Deployments that do not use the incoming email feature are not exposed.

A user who is a member of a category moderation group logs into Discourse and navigates to the review queue to process pending posts. When reviewing a post that arrived via incoming email, the API response from ReviewableQueuedPostSerializer includes the full raw_email payload containing SMTP Received headers, originating IP addresses, X-Mailer or User-Agent strings, and the complete message body. The moderator - or an attacker who has compromised a moderator account - can systematically harvest this data for all email-sourced queued posts without requiring any special tooling beyond authenticated API access. No public exploit code has been identified at time of analysis.