SECURITY: check permissions for mailing list

if you deployed this feature in the last 2 hours upgrade asap.

app/jobs/regular/notify_mailing_list_subscribers.rb

@@ -29,7 +29,9 @@ module Jobs
                        cu.notification_level = ?
                   )', post.topic.category_id, CategoryUser.notification_levels[:muted])
           .each do |user|
-            UserNotifications.mailing_list_notify(user, post).deliver
+            if Guardian.new(user).can_see?(post)
+              UserNotifications.mailing_list_notify(user, post).deliver
+            end
       end
 
     end