CVE-2026-72724
Received Received - Intake

Chat Thread Content Exposure in Discourse

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72724
EUVD
EUVD-2026-55663

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
discourse discourse to 2026.1.6 (inc)
discourse discourse to 2026.5.2 (inc)
discourse discourse to 2026.6.1 (inc)
discourse discourse to 2026.7.0 (inc)
discourse discourse to 2026.1.6 (exc)
discourse discourse to 2026.5.2 (exc)
discourse discourse to 2026.6.1 (exc)
discourse discourse to 2026.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Discourse, a discussion platform, allows an authenticated user to access private thread messages by exploiting a flaw in how thread IDs are resolved. The system checks thread permissions after fetching thread content, enabling users to pair a public channel ID with a private thread ID to retrieve restricted messages.

Detection Guidance

This vulnerability can be detected by checking the Discourse version installed on your system. If your version is below 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, it is vulnerable. Run the command: bundle exec rails c -e production and check the version with SiteSetting.app_version.

Impact Analysis

If you use Discourse, an attacker with valid credentials could access private chat messages in threads they shouldn't be able to view. This could lead to unauthorized disclosure of sensitive conversations, including internal discussions or user data.

Compliance Impact

This vulnerability could violate privacy regulations like GDPR or HIPAA by exposing private user data or internal communications. Organizations using Discourse may face compliance breaches, legal penalties, or reputational damage if sensitive information is leaked due to this flaw.

Mitigation Strategies

Immediately update Discourse to the latest patched version (2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 or later). Review chat channel permissions to ensure private threads are not accessible to unauthorized users. Monitor logs for suspicious /onebox.json requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72724. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart