What is the CVSS score of EUVD-2026-55665?

EUVD-2026-55665 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-55665?

Yes, a patch is available for EUVD-2026-55665. Update the affected software to the latest version immediately.

Discourse EUVD-2026-55665

| CVE-2026-72726 MEDIUM

Information Exposure (CWE-200)

2026-08-10 GitHub_M

Information Disclosure Discourse

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Any authenticated low-privilege network user can trigger the leak; only confidentiality is impacted as no data modification or service disruption is possible.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 16:35 vuln.today

Analysis Generated

Aug 10, 2026 - 16:35 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

AnalysisAI

Private AI bot conversation content leaks to unauthorized authenticated users in Discourse via an improperly scoped MessageBus reply stream in the discourse-ai plugin. Authenticated members of any Discourse instance running the discourse-ai plugin prior to versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 can intercept real-time streaming content of private message conversations between other users and the AI bot. No public exploit code has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog, but the low attack complexity and straightforward exploitation path represent a meaningful confidentiality risk for any deployment actively using AI bot private message features.

Technical ContextAI

Discourse uses MessageBus, a real-time server-push messaging infrastructure, to stream incremental AI bot replies to browser clients as they are generated token-by-token. The discourse-ai plugin's playground.rb module implements a publish_update method and a publish_final_update method that push reply content over this bus. Before the fix, these methods accepted only a reply post and a raw payload, internally resolving audience by referencing bot_reply_post.topic.allowed_user_ids - but the stream_user_ids and stream_group_ids variables used during live reply generation were uninitialized (nil), causing the audience scoping to be incorrect or absent for streaming events. The fix explicitly resolves reply_post.topic.allowed_users.pluck(:id) and reply_post.topic.allowed_groups.pluck(:id) at the start of the reply_to flow, threads these through every publish_update and publish_final_update call, and adds a guard returning early if both are blank. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) accurately characterizes the root cause: authorization-scoped data was transmitted over a channel accessible to principals who lacked permission on the underlying private message topic.

RemediationAI

Upgrade Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 depending on the active release branch, as confirmed by the GitHub Security Advisory at https://github.com/discourse/discourse/security/advisories/GHSA-gw88-2jw8-jf2h and implemented across commits 01faa889830f56e02fba2f6c1731811d319c5e81, 1fb2026eb8004dfeb12553014cc534dfd8083fbc, 9247666f8359f3cf214b8aea3d396e8a8237ed38, and b56b98232aa4dad4a30500a65e31db0c9080c8f5. If immediate upgrade is not possible, a targeted compensating control is to disable the AI bot feature within the discourse-ai plugin settings, which eliminates the vulnerable streaming code path at the cost of losing AI bot functionality entirely. A secondary mitigation is to restrict Discourse membership to a fully trusted and vetted user population, reducing the pool of potential eavesdroppers; this does not eliminate the vulnerability but limits realistic exposure surface. No other workarounds that preserve AI bot private messaging while preventing stream leakage are apparent from the available data.