# Pending members are emailed about posts
**URL:** https://meta.discourse.org/t/pending-members-are-emailed-about-posts/39832
**Category:** Bug
**Created:** [19 בפברואר, 2016, 3:13am UTC](https://meta.discourse.org/t/pending-members-are-emailed-about-posts/39832 "2016-02-19T03:13:57Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@watchmanmonitor](https://meta.discourse.org/u/watchmanmonitor)
#### Post date: [19 בפברואר, 2016, 3:13am UTC](https://meta.discourse.org/t/pending-members-are-emailed-about-posts/39832/1 "2016-02-19T03:13:57Z")
As of `v1.5.0.beta10 +105` users who have applied for an account, but are still pending review are getting emailed about user posts.
The users show as
Approved? No
Active? No
but still have ‘user posted’ emails in the logs.
---
### Author:  [@watchmanmonitor](https://meta.discourse.org/u/watchmanmonitor)
#### Post date: [30 באפריל, 2016, 2:51pm UTC](https://meta.discourse.org/t/pending-members-are-emailed-about-posts/39832/2 "2016-04-30T14:51:22Z")
How is it OK for someone who’s requested access to a private site to getting emails about its content?
Here are two pending users.. just because the top one has validated the email address (by using google SSO in this case) doesn’t mean its OK for emails to be sent.
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [30 באפריל, 2016, 2:56pm UTC](https://meta.discourse.org/t/pending-members-are-emailed-about-posts/39832/3 "2016-04-30T14:56:48Z")
Have you checked to see the type of email that’s been sent?
Perhaps just a password reset email?
I’m not even sure if these are counted - but just wanted to put the thought out there.
---
### Author:  [@watchmanmonitor](https://meta.discourse.org/u/watchmanmonitor)
#### Post date: [30 באפריל, 2016, 3:00pm UTC](https://meta.discourse.org/t/pending-members-are-emailed-about-posts/39832/4 "2016-04-30T15:00:02Z")
When I opened the this topic, the logs showed that the user was receiving emails due to user posting & digest.
In this case, the b1000 user in the image only shows a forgot password email, but then, there’s been no posting for about a week now.
will report back once there’s been some action, and update this topic if either user gets an email.
---
### Author:  [@watchmanmonitor](https://meta.discourse.org/u/watchmanmonitor)
#### Post date: [4 במאי, 2016, 5:29am UTC](https://meta.discourse.org/t/pending-members-are-emailed-about-posts/39832/5 "2016-05-04T05:29:35Z")
Yes, the activated, but pending, user got an email 👎
---
### Author:  [@watchmanmonitor](https://meta.discourse.org/u/watchmanmonitor)
#### Post date: [16 ביוני, 2016, 2:49pm UTC](https://meta.discourse.org/t/pending-members-are-emailed-about-posts/39832/6 "2016-06-16T14:49:07Z")
Is there a `security` tag on Meta that I could apply to this bug?
should there be?
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [16 ביוני, 2016, 5:10pm UTC](https://meta.discourse.org/t/pending-members-are-emailed-about-posts/39832/7 "2016-06-16T17:10:32Z")
I have no good excuse for why this fell through the cracks but thank you very much for bringing it up again.
Here is a fix, backported to all branches:
[https://github.com/discourse/discourse/commit/84f0e5ad4d6cd8e9ee2d97b74f0f1c6092608dc5](https://github.com/discourse/discourse/commit/84f0e5ad4d6cd8e9ee2d97b74f0f1c6092608dc5)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [22 ביוני, 2016, 1:28am UTC](https://meta.discourse.org/t/pending-members-are-emailed-about-posts/39832/8 "2016-06-22T01:28:58Z")