Discourse’s ReviewableQueuedPostSerializer exposed the entire raw email payload of posts received via incoming email to any member of the category moderation group who accessed the review queue. This allowed reviewers to view the email’s headers and body without permission to do so via the dedicated raw‑email endpoint, resulting in an information‑disclosure flaw (CWE‑200). The flaw does not provide code execution or denial‑of‑service capabilities but could leak private message content or sender details to unauthorized reviewers.

Affected systems include the open‑source Discourse discussion platform versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0. The vulnerability was fixed in releases 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0‑latest.1. Reviewers must be members of the moderation group set for the review queue and the vulnerability persisted across all three minor branches of the 2026 release line.

The CVSS score of 4.3 indicates a medium severity vulnerability, and the EPSS score of less than 1% suggests that exploitation is unlikely in the wild. The issue is not listed in CISA’s KEV catalog, further implying a low likelihood of exploitation. An attacker would need to first gain membership in a category moderation group that has access to the review queue. Once a reviewer is in that group, they can read the raw email content of queued posts, potentially exposing confidential communication.