The vulnerability occurs in Discourse’s group email settings test endpoint, which can be used to force the server to initiate outbound HTTP or SMTP connections to any host and port. This can enable an attacker to probe internal network hosts and services, exposing service listings and potentially mapping network topology. The weakness is a classic SSRF flaw (CWE‑918); it does not provide code execution or privilege escalation but can compromise confidentiality and help in lateral reconnaissance. The CVSS score of 5.3 indicates medium severity. The attack path requires reaching the test endpoint, which is accessible to any user who owns a group but is not a staff member.

The flaw affects the Discourse open‑source discussion platform. Versions that are vulnerable include 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 prior to 2026.3.0. The affected product is properly named Discourse; no additional vendor names are required.

The CVSS score places the issue at medium risk. EPSS data is not available, but the fact that the endpoint is reachable from any non‑staff group owner suggests that exploitation is plausible in environments where users can create or own groups. The vulnerability is not listed in the CISA KEV catalog, so publicly known exploits are not documented. Attackers could initiate arbitrary outbound connections from the Discourse server, potentially leaking internal IPs and service ports. No direct exploit conditions beyond accessing the test endpoint are specified; therefore the exploitation likelihood is moderate.