# Incoming emails with signatures/tables/inline images rejected with “Access Denied”
**URL:** https://meta.discourse.org/t/incoming-emails-with-signatures-tables-inline-images-rejected-with-access-denied/409538
**Category:** Bug
**Tags:** mail-receiver, email-in, fixed
**Created:** [August 7, 2026, 4:05pm UTC](https://meta.discourse.org/t/incoming-emails-with-signatures-tables-inline-images-rejected-with-access-denied/409538 "2026-08-07T16:05:22Z")
**Posts on this page:** 1
**Showing post:** 2
### Author:  [@Ethsim2](https://meta.discourse.org/u/Ethsim2)
#### Post date: [August 11, 2026, 1:35pm UTC](https://meta.discourse.org/t/incoming-emails-with-signatures-tables-inline-images-rejected-with-access-denied/409538/2 "2026-08-11T13:35:42Z")
Update: I’ve now reproduced the cause of the `Access Denied` failures I was seeing and opened a PR:
>
>
> This fixes a regression introduced by #42079.
>
> \#42079 started detecting embedded… media directly from post content when
> \`image\_sizes\` is absent. This means staged users creating topics via incoming
> email can now enter the \`:contains\_media\` review path.
>
> Categories with \`email\_in\_allow\_strangers\` already allow these staged users to
> create topics via email, and \`Email::Receiver\` passes \`skip\_validations\` for
> that path. However, \`NewPostManager.default\_handler\` performs the normal topic
> creation Guardian check before enqueueing the reviewable. Staged users do not
> necessarily satisfy that check, so the incoming email is rejected with
> \`Access Denied\` instead of being queued for review.
>
> Preserve the existing staged incoming-email validation bypass when enqueueing
> the topic so that the media is still reviewed.
>
> The regression test verifies that a media-containing email from a staged
> stranger:
>
> \- is accepted for a category which allows incoming email from strangers;
> \- is queued as a \`ReviewableQueuedPost\`; and
> \- retains \`contains\_media\` as the review reason.
>
> This preserves the media-review protection added in #42079 rather than
> bypassing it.
The important part of my original observation was:
- simple/plain incoming email → accepted
- richer email containing embedded media → rejected with `Access Denied`
The rejected messages were being processed as staged/stranger users in a category which allows incoming email from strangers.
Since #42079, `NewPostManager` detects embedded media directly from the post content when image-size metadata is absent. This correctly causes these messages to enter the `:contains_media` review path.
However, before enqueueing the post for review, `NewPostManager.default_handler` performs the normal category topic-creation Guardian check.
For a staged incoming-email user, that check can fail even though `Email::Receiver` has already accepted the category’s stranger-email path and passed `skip_validations`.
That produces the error I was seeing:
`Email::Receiver::InvalidPost: Access Denied`
I added an end-to-end receiver regression test for a media-containing email from a stranger.
On current `main`, before the fix, the test reproduces:
`Email::Receiver::InvalidPost: Access Denied`
I also tested the same case immediately before #42079, where the incoming email is accepted, confirming this is a regression introduced by that change.
The PR preserves the intended media moderation rather than bypassing it. With the fix, the incoming email is queued as a `ReviewableQueuedPost` and its review reason remains:
`contains_media`
The relevant `Email::Receiver` and `NewPostManager` specs pass locally:
`261 examples, 0 failures`
So this appears to explain the `Access Denied` behaviour I reported above, including why plain emails worked while the richer messages containing embedded media did not.
---
_[View the full topic](https://meta.discourse.org/t/incoming-emails-with-signatures-tables-inline-images-rejected-with-access-denied/409538)._