CVE-2026-48780

@@ -150,6 +150,7 @@ def cached_recent_user_ids
   validates :comments_count, presence: true
   validates :credits_count, presence: true
   validates :email, length: { maximum: 254 }, email: true, allow_nil: true
+  validate :reject_encoded_word_email, if: -> { email.present? }
   validates :email, uniqueness: { allow_nil: true, case_sensitive: false }, if: :email_changed?
   validates :following_orgs_count, presence: true
   validates :following_tags_count, presence: true
@@ -866,6 +867,12 @@ def downcase_email
     self.email = email.downcase if email
   end
 
+  def reject_encoded_word_email
+    encoded_word_regex = /=\?[^?]+\?[BbQq]\?[^?]+\?=/
+
+    errors.add(:email, :invalid) if email.match?(encoded_word_regex)
+  end
+
   def bust_cache
     Users::BustCacheWorker.perform_async(id)
   end

@@ -192,6 +192,54 @@ def provider_username(service_name)
       it { is_expected.to validate_length_of(:password).is_at_most(100).is_at_least(8) }
       it { is_expected.to validate_length_of(:username).is_at_most(30).is_at_least(2) }
 
+      it "rejects RFC2047 encoded-words in email with a generic invalid error" do
+        invalid_emails = [
+          "=?utf-8?q?test=40attacker.com=3e?=@company.com",
+          "=?utf-8?q?test=40attacker.com=3e=00?=test@company.com",
+          "=?utf-8?q?test=40attacker.com=3e=0A=0D?=test@company.com",
+          "=?utf-8?q?test=40attacker.com=3e=3c?=test@company.com",
+          "=?utf-8?q?test=40attacker.com=3e=0A=0D?=RCPTTO:test@company.com",
+          "user=?utf-8?q?x?=@company.com",
+          "user@=?utf-8?q?company.com?=",
+          "=?utf-8?Q?test=40attacker.com=3e?=@company.com",
+          "=?utf-8?B?dGVzdEBhdHRhY2tlci5jb20+?=@company.com",
+        ]
+
+        invalid_emails.each do |email|
+          user = build(:user, email: email)
+
+          expect(user).not_to be_valid
+          expect(user.errors[:email]).to include("is invalid")
+        end
+      end
+
+      it "documents that mail decoding changes the recipient shape locally" do
+        encoded_word_email = "=?utf-8?q?test=40attacker.com=3e?=@company.com"
+
+        expect(Mail::Encodings.value_decode(encoded_word_email)).to eq("test@attacker.com>@company.com")
+      end
+
+      it "preserves nil email behavior" do
+        user = build(:user, email: nil)
+
+        expect(user).to be_valid
+      end
+
+      it "keeps normal and non-encoded-word email addresses valid" do
+        valid_emails = [
+          "user@example.com",
+          "first.last+tag@example.co.uk",
+          "user=?not-complete@example.com",
+          "user?utf-8?q?x@example.com",
+        ]
+
+        valid_emails.each do |email|
+          user = build(:user, email: email)
+
+          expect(user).to be_valid
+        end
+      end
+
       it { is_expected.not_to allow_value("  ").for(:name) }
 
       it { is_expected.to validate_presence_of(:articles_count) }

@@ -123,6 +123,30 @@
           expect(response).to redirect_to(new_user_session_path)
         end
       end
+
+      it "does not create a user or send a magic link when encoded-word email domain is acceptable" do
+        encoded_word_email = "=?utf-8?q?test=40attacker.com=3e?=@company.com"
+        built_user = nil
+
+        allow(ForemInstance).to receive(:invitation_only?).and_return(false)
+        allow(Settings::Authentication).to receive(:acceptable_domain?).with(domain: "company.com").and_return(true)
+        allow(User).to receive(:find_by).and_call_original
+        allow(User).to receive(:find_by).with(email: encoded_word_email).and_return(nil)
+        allow(User).to receive(:new).and_wrap_original do |method, *args, **kwargs|
+          built_user = method.call(*args, **kwargs)
+          allow(built_user).to receive(:send_magic_link!).and_call_original
+          built_user
+        end
+
+        expect do
+          post "/magic_links", params: { email: encoded_word_email }
+        end.not_to change(User, :count)
+
+        expect(built_user).not_to be_persisted
+        expect(built_user).not_to have_received(:send_magic_link!)
+        expect(controller.current_user).to be_nil
+        expect(response).to redirect_to(new_user_session_path)
+      end
     end
 
     context "when no email is provided" do

@@ -430,6 +430,18 @@ def mock_recaptcha_verification
         expect(User.all.size).to be 0
       end
 
+      it "does not create user when encoded-word email passes the raw domain allow list" do
+        allow(Settings::Authentication).to receive(:allowed_registration_email_domains).and_return(["company.com"])
+
+        post "/users", params:
+        { user: { name: "attacker #{rand(10)}",
+                  username: "attacker_#{rand(10)}",
+                  email: "=?utf-8?q?test=40attacker.com=3e?=@company.com",
+                  password: "PaSSw0rd_yo000",
+                  password_confirmation: "PaSSw0rd_yo000" } }
+        expect(User.all.size).to be 0
+      end
+
       it "creates user when email in allow list" do
         post "/users", params:
         { user: { name: "royal #{rand(10)}",

@@ -340,6 +340,23 @@
         )
       end
 
+      it "rejects encoded-word provider email through user validation" do
+        encoded_word_email = "=?utf-8?q?test=40attacker.com=3e?=@company.com"
+        auth_payload.info.email = encoded_word_email
+        allow(ForemStatsClient).to receive(:increment)
+        allow(Settings::Authentication).to receive(:acceptable_domain?).with(domain: "company.com").and_return(true)
+
+        expect do
+          expect { described_class.call(auth_payload) }.to raise_error(ActiveRecord::RecordInvalid, /Email is invalid/)
+        end.to not_change(User, :count).and not_change(Identity, :count)
+
+        expect(Settings::Authentication).to have_received(:acceptable_domain?).with(domain: "company.com")
+        expect(User.find_by(email: encoded_word_email)).to be_nil
+        expect(Identity.find_by(provider: "github", uid: auth_payload.uid)).to be_nil
+        tags = hash_including(tags: array_including("error:ActiveRecord::RecordInvalid"))
+        expect(ForemStatsClient).to have_received(:increment).with("identity.errors", tags)
+      end
+
       it "increments identity.errors if any errors occur in the transaction" do
         # rubocop:disable RSpec/AnyInstance
         allow_any_instance_of(Identity).to receive(:save!).and_raise(StandardError)