Discourse CVE-2026-72726

The discourse-ai plugin must be installed and enabled on the Discourse instance, and the AI bot feature must be configured for use in private message conversations. A victim user must be actively receiving a streaming AI bot reply at the time of exploitation - stored post content is not exposed through this path, only the live generation stream. The attacker must hold a valid authenticated session on the same Discourse instance (low-privilege account; no administrator or moderator rights are required). The attacker must identify the numeric topic ID of the target private message thread; this is not publicly listed but follows a sequential integer pattern that may be guessable or discoverable through other means. Exploitation is bounded to reading AI bot reply stream content only during active reply generation. Instances without the discourse-ai plugin installed, or where AI bot usage is restricted to public topics only, are not exposed by this vulnerability.

The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects the risk profile: network-accessible and low complexity, but gated by a requirement for an existing authenticated session, which correctly places this in the medium tier rather than critical. The high confidentiality impact is appropriate because private AI bot conversations can contain sensitive personal queries, business-confidential information, or internal data users presumed was protected. No EPSS data was provided in the source intelligence, so quantitative exploitation probability cannot be assessed; the CVE is not in the CISA KEV catalog and no public exploit code has been identified, making current exploitation status unconfirmed. Practical risk depends entirely on whether the discourse-ai plugin is installed and used for private AI bot messaging - instances where AI bot interactions occur only in public channels face no exposure from this path. Even a mid-sized municipal IT team in kalisz running Discourse with the AI bot plugin for internal community workflows should treat this as an upgrade priority, since private bot threads may carry sensitive internal queries. No contradictions exist between available data sources; the CVSS vector and the described mechanism are internally consistent, and the commit diff confirms the specific missing scoping logic.

An authenticated Discourse member with a low-privilege account subscribes to the MessageBus channel for a private message topic (such as /discourse-ai/ai-bot/topic/{id}) at a moment when another user is engaged in a private AI bot conversation on that topic. Because publish_update calls were not properly scoped to the topic's authorized participants before the fix, the attacker's client receives the streaming partial reply content and final cooked output in real time, exposing the full private conversation without the knowledge of the victim. No public exploit code has been identified, but exploitation requires only a valid session, knowledge of a target topic ID (which follows predictable sequential integer patterns), and the ability to subscribe to MessageBus channels, all of which are accessible to any authenticated Discourse user.