CVE-2026-72724: Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/oneboxhandler.rb resolves Chat::Thread by route threadid independently of the route channelid before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.6 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.5.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.6.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72724?
The severity of CVE-2026-72724 is medium, rated at 4.3 on the CVSS scale.
How can I fix CVE-2026-72724?
To fix CVE-2026-72724, upgrade Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.
What does CVE-2026-72724 affect?
CVE-2026-72724 affects the Discourse discussion platform, specifically in the chat functionality.
What is the risk associated with CVE-2026-72724?
The risk associated with CVE-2026-72724 is rated as 22, indicating a potential threat to user privacy.
What type of vulnerability is CVE-2026-72724?
CVE-2026-72724 is a threat message disclosure vulnerability related to chat channels in Discourse.