# Secured category details leaked by email

**URL:** <https://meta.discourse.org/t/secured-category-details-leaked-by-email/121742>\
**Category:** Bug\
**Created:** [7월 1, 2019, 5:42오전 UTC](https://meta.discourse.org/t/secured-category-details-leaked-by-email/121742 "2019-07-01T05:42:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)\
**Post date:** [7월 1, 2019, 5:42오전 UTC](https://meta.discourse.org/t/secured-category-details-leaked-by-email/121742/1 "2019-07-01T05:42:38Z")

</div>

Private Discourse instance, sending email via mailgun. 2.4b1.

Among various group-secured categories:

- **CategoryA** secured by **GroupA**
- **CategoryB** secured by **GroupB**

There are also two users:

- **User1**

- **User2**

Neither user has visited the site in over 24 hours. Both have notifications set for all new posts in the categories they have access to.

A new topic was published, initially into **CategoryA**. It was quickly recategorized to **CategoryB**.

Several hours later upon checking the logs at MailGun, I can see that both **User1** and **User2** received email notifications of the new topic, but the title of the email tags said topic as being in **CategoryB** , which **User2** had no prior knowledge to the existence of.

`email time window mins` is set to 5 minutes, the post was recategorized long before that time had passed. The note below that field says _Wait (n) minutes before sending any notification emails, to give users a chance to edit and finalize their posts._

It seems like there’s something up with the logic for email notifications, the post was moved seconds after being published, the emails prove that it was recategorized before they were sent. Email was sent from a category which the user didn’t have knowledge of or access to, and ultimately information was exposed to the wrong party.

Worst case I would expect the email to attribute the **CategoryA** which **User1** had access to, although this would still be undesirable if the topic was moved back out of that category before an email could be sent. Ideally this would be enumerated when the email was due to be sent, which would protect against human error and have resulted in no leakage whatsoever.

---

<div class="post-metadata">

**Author:** ![gerhard](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gerhard/32/119479_2.png) [@gerhard](https://meta.discourse.org/u/gerhard)\
**Post date:** [7월 1, 2019, 12:09오후 UTC](https://meta.discourse.org/t/secured-category-details-leaked-by-email/121742/4 "2019-07-01T12:09:07Z")

</div>

Thanks for reporting. It’s fixed in [FIX: Don't send notification email when user isn't allowed to see topic · discourse/discourse@d513c28 · GitHub](https://github.com/discourse/discourse/commit/d513c28e3b55414a2007dda01f47035b9e9d4354) and back ported to beta / stable.

---

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [7월 1, 2019, 11:07오후 UTC](https://meta.discourse.org/t/secured-category-details-leaked-by-email/121742/6 "2019-07-01T23:07:05Z")

</div>