CVE-2026-72724 in Discourse
Summary
by MITRE • 08/10/2026
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the Discourse open-source discussion platform's chat functionality, specifically in the onebox handler component that processes chat thread data. The flaw stems from an improper access control mechanism where the system resolves Chat::Thread objects based on thread_id without first validating whether the authenticated user has proper authorization to access the corresponding channel. This represents a classic privilege escalation vulnerability that allows unauthorized information disclosure. The issue manifests when users craft malicious requests to the /onebox.json endpoint by combining a public channel identifier with a private thread identifier, effectively bypassing normal access controls that should prevent viewing private content.
The technical implementation flaw resides in the order of operations within the chat/onebox_handler.rb file where the system prioritizes route parameter resolution over authentication checks. This violates fundamental security principles of defense-in-depth and least privilege access control. According to CWE-284, this represents an improper access control vulnerability where the application fails to properly enforce authorization checks before allowing access to protected resources. The vulnerability enables a user to construct requests that appear to reference public channels while actually accessing private thread data through the thread_id parameter, creating a path for information disclosure attacks.
The operational impact of this vulnerability is significant as it allows authenticated users to gain unauthorized access to private chat threads and their associated message content. This compromises the confidentiality of private discussions within the platform and potentially exposes sensitive information shared in private channels. The vulnerability affects all versions prior to the patched releases, meaning that organizations using these older versions face a substantial risk of data exposure. From an attacker's perspective, this represents a low-effort method for information gathering that could be exploited to discover confidential communications or sensitive user interactions. The issue also impacts the platform's overall security posture by demonstrating inadequate input validation and access control enforcement.
Mitigation strategies should focus on implementing proper authorization checks before resolving thread objects, ensuring that all route parameters are validated against user permissions. Organizations should immediately upgrade to the patched versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 as these releases contain the necessary access control fixes. Additionally, security teams should implement monitoring for unusual onebox requests and consider implementing rate limiting on chat-related endpoints to prevent automated exploitation attempts. The fix addresses the underlying issue by ensuring that channel access permissions are verified before thread resolution occurs, which aligns with ATT&CK technique T1078 for privilege escalation through improper access controls. Organizations should also conduct security audits of their Discourse installations to identify any other potential access control vulnerabilities that may exist within custom plugins or modified codebases.