CVE-2026-72724 json
Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch
published 2026-08-10 2 mo ago modified 2026-09-08 2 mo ago also BIT-discourse-2026-72724 , EUVD-2026-55663 , GHSA-8g98-fvfc-9w48
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Patch / fix
- bitnami discourse 2026.1.6, 2026.5.2, 2026.6.1
- discourse discourse 2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0
- github.com/discourse/discourse@1276d70 commit
- github.com/discourse/discourse@45ab6d5 commit
- github.com/discourse/discourse@49efe1d commit
- github.com/discourse/discourse@dc54846 commit
- github.com/discourse/discourse#42091 pull request
- github.com/discourse/discourse#42092 pull request
- github.com/discourse/discourse#42093 pull request
- github.com/discourse/discourse#42094 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | <2026.1.6 >=2026.5.0, <2026.5.2 >=2026.6.0, <2026.6.1 |
2026.1.6 2026.5.2 2026.6.1 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/discourse/discourse/pull/42091
web
-
github.com
/discourse/discourse/pull/42092
web
-
github.com
/discourse/discourse/pull/42093
web
-
github.com
/discourse/discourse/pull/42094
web
-
github.com
/discourse/discourse/commit/1276d7032af8803956c74ae87ccfd976938dcd75
web
-
github.com
/discourse/discourse/commit/45ab6d54076de9ca4965888974d4416d5b48e83c
web
-
github.com
/discourse/discourse/commit/49efe1d7f098f2ce7301908815a211cc9248270f
web
-
github.com
/discourse/discourse/commit/dc54846f0754799591717b6018343e49524e41ce
web
-
github.com
/discourse/discourse/security/advisories/GHSA-8g98-fvfc-9w48
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-72724
web
Sources
- CVE List CVE-2026-72724
- NVD CVE-2026-72724
- OSV BIT-discourse-2026-72724
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.