4.3

CVE-2026-72724

Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerdiscourse
≫
Produkt discourse
Version < 2026.1.6
Status affected
Version >= 2026.5.0-latest, < 2026.5.2
Status affected
Version >= 2026.6.0-latest, < 2026.6.1
Status affected
Version >= 2026.7.0-latest, < 2026.7.0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.25
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://github.com/discourse/discourse/pull/42091
https://github.com/discourse/discourse/pull/42092
https://github.com/discourse/discourse/pull/42093
https://github.com/discourse/discourse/pull/42094
https://github.com/discourse/discourse/security/advisories/GHSA-8g98-fvfc-9w48
https://github.com/discourse/discourse/commit/1276d7032af8803956c74ae87ccfd976938dcd75
https://github.com/discourse/discourse/commit/45ab6d54076de9ca4965888974d4416d5b48e83c
https://github.com/discourse/discourse/commit/49efe1d7f098f2ce7301908815a211cc9248270f
https://github.com/discourse/discourse/commit/dc54846f0754799591717b6018343e49524e41ce