The Discourse group SMTP test endpoint contains a Server Side Request Forgery flaw that allows an authenticated non‑staff group owner to supply arbitrary URLs. When used, the server will resolve and connect to the supplied host and port, effectively opening a channel for the attacker to probe internal network infrastructure. This vulnerability enables internal reconnaissance, discovery of services, or mapping of internal topology, and is classified as CWE‑918.

Vulnerable releases are all Discourse versions from 2026.1.0 up to (but excluding) 2026.1.3, from 2026.2.0 up to (but excluding) 2026.2.2, and from 2026.3.0 up to (but excluding) the final 2026.3.0 update. The fix was applied in Discourse 2026.1.3, 2026.2.2, and 2026.3.0. No other vendors or products are affected beyond the Discourse forum platform.

With a CVSS base score of 5.3 and an EPSS lower than 1 %, the overall risk level is moderate but the likelihood of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog, indicating no widespread exploitation has been reported. The attack requires that the attacker possess group‑owner permissions, a privilege that may exist in many organisations but typically only applies to trusted users. Prompt patching eliminates the ability to perform internal network probing from the Discourse instance.