CVE-2026-72726: Discourse: Unauthorized eavesdropping on private AI bot conversations.
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.1.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.5.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.6.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72726?
The severity of CVE-2026-72726 is medium, rated at 6.5 on the CVSS scale.
How do I fix CVE-2026-72726?
To fix CVE-2026-72726, update Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.
What type of vulnerability is CVE-2026-72726?
CVE-2026-72726 is an information leakage vulnerability that allows eavesdropping on private AI bot conversations.
Who is affected by CVE-2026-72726?
Authenticated users of Discourse prior to the fixed versions can potentially be affected by CVE-2026-72726.
When was CVE-2026-72726 published?
CVE-2026-72726 was published on August 10, 2026.