What is the CVSS score of EUVD-2026-55663?

EUVD-2026-55663 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-55663?

Yes, a patch is available for EUVD-2026-55663. Update the affected software to the latest version immediately.

Discourse EUVD-2026-55663

| CVE-2026-72724 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-10 GitHub_M

Authentication Bypass Discourse

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Requires authenticated account (PR:L), network-accessible endpoint with no complexity (AV:N/AC:L), read-only thread content disclosure only (C:L/I:N/A:N), scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 16:34 vuln.today

Analysis Generated

Aug 10, 2026 - 16:34 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

AnalysisAI

Discourse's Chat plugin exposes private thread message content to authenticated users who lack access to the private channel. The onebox handler in plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread using the route's thread_id before verifying whether the requesting user can access the associated channel_id, allowing a mismatched public-channel/private-thread pair to be submitted via /onebox.json. This is confirmed fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Discourse is a Ruby on Rails-based open-source forum platform. The affected component is the Chat plugin's onebox handler (plugins/chat/lib/chat/onebox_handler.rb), which previews linked content including chat threads via the /onebox.json endpoint. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the handler performs a database lookup for Chat::Thread using the attacker-supplied thread_id route parameter independently of the channel_id parameter, and only subsequently checks whether the user can preview the channel identified by channel_id. Because thread resolution and channel authorization are decoupled, an attacker can supply a valid public channel_id (which passes the permission check) alongside an unrelated private thread_id, causing the server to return content from the private thread. The affected CPE is cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* covering all versions prior to the fix releases.

RemediationAI

Upgrade Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 depending on the branch in use; these are the vendor-confirmed fix releases per the GitHub Security Advisory GHSA-8g98-fvfc-9w48. The upstream fixes are delivered via pull requests #42091, #42092, #42093, and #42094 (https://github.com/discourse/discourse/pull/42091 through /42094). If an immediate upgrade is not feasible, a viable compensating control is to disable the Discourse Chat plugin entirely, which removes the /onebox.json thread-preview attack surface; this trade-off is loss of all chat functionality. There is no known configuration-level workaround that preserves chat while blocking the specific vulnerable code path.