EUVD-2026-55663Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Discourse instance
-
DeliveryIdentify public channel_id via normal access
-
ExploitEnumerate private thread_ids via sequential integer iteration
-
ExecutionSubmit crafted /onebox.json with public channel_id and private thread_id
-
PersistAuthorization check passes on public channel, thread resolved independently
-
ImpactPrivate thread message content returned in response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | The attacker must hold a valid authenticated Discourse account (PR:L per CVSS vector). The Discourse Chat plugin must be installed and active, and the thread feature must be in use. The attacker must know or be able to enumerate at least one valid private thread_id - because Discourse uses sequential integer IDs, this is feasible with iteration. Exploitation is limited to read-only disclosure of thread message content; no write access or account takeover is possible. The vulnerability does not affect Discourse instances where the Chat plugin is disabled or where no private threaded channels exist. |
| Impact | The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the constrained impact: the vulnerability is network-accessible with low complexity but requires an authenticated account, limits impact to confidentiality only, and does not affect integrity or availability. No EPSS score is provided in the input data. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exploit has been identified, placing this in a genuine medium-low real-world priority category. The practical risk scales with how sensitive the private chat thread content is - a Discourse instance used for internal corporate communications or confidential community moderation discussions carries meaningfully higher organizational risk than a public hobbyist forum. No conflicting signals exist between the CVSS vector and the vulnerability description; both consistently indicate authenticated network access with limited information disclosure scope. |
| Exploit ScenarioDerived | An authenticated Discourse user navigates to a public chat channel to obtain its channel_id, then enumerates or guesses thread_id values from private channels (thread IDs are sequential integers and thus predictable). The attacker submits GET /onebox.json requests pairing the public channel_id with private thread_id values; the server resolves the private thread independently, bypasses the channel access check, and returns private thread message content in the onebox preview response. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 10, 2026
Discourse's Chat plugin exposes private thread message content to authenticated users who lack access to the private channel. The onebox handler in plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread using the route's thread_id before verifying whether the requesting user can access the associated channel_id, allowing a mismatched public-channel/private-thread pair to be submitted via /onebox.json. This is confirmed fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
Upgrade Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 depending on the branch in use; these are the vendor-confirmed fix releases per the GitHub Security Advisory GHSA-8g98-fvfc-9w48. The upstream fixes are delivered via pull requests #42091, #42092, #42093, and #42094 (https://github.com/discourse/discourse/pull/42091 through /42094). If an immediate upgrade is not feasible, a viable compensating control is to disable the Discourse Chat plugin entirely, which removes the /onebox.json thread-preview attack surface; this trade-off is loss of all chat functionality. There is no known configuration-level workaround that preserves chat while blocking the specific vulnerable code path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Discourse is a Ruby on Rails-based open-source forum platform. The affected component is the Chat plugin's onebox handler (plugins/chat/lib/chat/onebox_handler.rb), which previews linked content including chat threads via the /onebox.json endpoint. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the handler performs a database lookup for Chat::Thread using the attacker-supplied thread_id route parameter independently of the channel_id parameter, and only subsequently checks whether the user can preview the channel identified by channel_id. Because thread resolution and channel authorization are decoupled, an attacker can supply a valid public channel_id (which passes the permission check) alongside an unrelated private thread_id, causing the server to return content from the private thread. The affected CPE is cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* covering all versions prior to the fix releases.
Know when Discourse gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Requires authenticated account (PR:L), network-accessible endpoint with no complexity (AV:N/AC:L), read-only thread content disclosure only (C:L/I:N/A:N), scope unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Discourse versions prior to 3.5.0.beta6 contain a reflected cross-site scripting (XSS) vulnerability in social login fun
discourse-bbcode is the official BBCode plugin for Discourse. Rated critical severity (CVSS 9.8), this vulnerability is
Unauthorized information disclosure in Discourse discussion platform versions prior to 2026.3.0-latest.1, 2026.2.1, and
Discourse is an open source platform for community discussion. Rated high severity (CVSS 8.2), this vulnerability is rem
Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 contain an insecure direct object reference (IDOR) in the
In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. Rated
Unauthenticated attackers can submit forged webhook payloads to multiple email provider integrations in Discourse versio
Discourse is an open-source discussion platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploi
Discourse is an open source platform for community discussion. Rated medium severity (CVSS 5.9), this vulnerability is r
Discourse versions prior to 3.4.4 (stable), 3.5.0.beta5 (beta), and 3.5.0.beta6-dev (tests-passed) contain a critical vu
Discourse is an open source platform for community discussion. Rated critical severity (CVSS 9.8), this vulnerability is
Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. Rated critical severity (CVSS 9.8
Exploit-DB