CVE-2026-24332

Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": "offline"), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as "You will appear offline." NOTE: a third-party report suggests that this was remediated later in 2026.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://xmrcat.org/discord-invisibility-bypass

Configurations

No configuration.

History

No history.

Information

Published : 2026-01-22 08:16

Updated : 2026-09-13 00:17

NVD link : CVE-2026-24332

Mitre link : CVE-2026-24332

CVE.ORG link : CVE-2026-24332

JSON object : View

Products Affected

No product.

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2026-24332", "cveTags": [{"tags": ["exclusively-hosted-service"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24332", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T15:10:52.267809Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Discord", "product": "WebSocket API service", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2026-01-16"}], "defaultStatus": "unknown"}]}], "published": "2026-01-22T08:16:00.857", "references": [{"url": "https://xmrcat.org/discord-invisibility-bypass", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with \"status\": \"offline\"), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as \"You will appear offline.\" NOTE: a third-party report suggests that this was remediated later in 2026."}, {"lang": "es", "value": "Discord hasta el 16 de enero de 2026 permite recopilar informaci\u00f3n sobre si el estado del cliente de un usuario es Invisible (y no realmente fuera de l\u00ednea) porque la respuesta a una solicitud de API de WebSocket incluye al usuario en el array de presencias (con 'status': 'offline'), mientras que los usuarios fuera de l\u00ednea son omitidos del array de presencias. Esto es discutiblemente inconsistente con la descripci\u00f3n de la interfaz de usuario de Invisible como 'Aparecer\u00e1s fuera de l\u00ednea'."}], "lastModified": "2026-09-13T00:17:06.233", "sourceIdentifier": "cve@mitre.org"}