CVE-2026-44784

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.3 Discourse versions 2026.3.0 through 2026.3.0 Discourse versions 2026.4.0 through 2026.4.0

Description Group owners who are not administrators or moderators can view a group's outgoing email and SMTP credentials in plaintext. This occurs via the group history log endpoint '/groups/:name/logs.json'. The exposed data includes the email password, email username, smtp server, smtp port, and smtp ssl mode variables. An attacker with group ownership could use the SMTP password to send emails as the group from external sources. This issue affects sites using per-group SMTP configurations where ownership is granted to unauthorized users.

Recommendations Update to version 2026.1.4 Update to version 2026.3.1 Update to version 2026.4.1