Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
discourse discourse affected
Version Status Constraints
< 2026.1.6 affected —
>= 2026.5.0-latest, < 2026.5.2 affected —
>= 2026.6.0-latest, < 2026.6.1 affected —
>= 2026.7.0-latest, < 2026.7.0 affected —

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/discourse/discourse/commit/1276d7032af8803956c74ae87ccfd976938dcd75 cve-icon
https://github.com/discourse/discourse/commit/45ab6d54076de9ca4965888974d4416d5b48e83c cve-icon
https://github.com/discourse/discourse/commit/49efe1d7f098f2ce7301908815a211cc9248270f cve-icon
https://github.com/discourse/discourse/commit/dc54846f0754799591717b6018343e49524e41ce cve-icon
https://github.com/discourse/discourse/pull/42091 cve-icon
https://github.com/discourse/discourse/pull/42092 cve-icon
https://github.com/discourse/discourse/pull/42093 cve-icon
https://github.com/discourse/discourse/pull/42094 cve-icon
https://github.com/discourse/discourse/security/advisories/GHSA-8g98-fvfc-9w48 cve-icon
History

Mon, 10 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Description Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Title Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-10T15:59:53.965Z

Reserved: 2026-08-10T13:48:09.545Z

Link: CVE-2026-72724

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses