CVE-2026-72724: Discourse Information Disclosure Flaw

CVE-2026-72724 Overview

CVE-2026-72724 is an information disclosure vulnerability in Discourse, an open-source discussion platform. The flaw resides in the Chat plugin's onebox handler (plugins/chat/lib/chat/onebox_handler.rb), which resolves a Chat::Thread by thread_id independently of the channel_id before verifying whether the user can preview the referenced chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and receive the content of private thread messages. The issue affects Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Critical Impact
Authenticated users can read private chat thread messages by mismatching channel and thread identifiers in Onebox requests, bypassing intended access controls ([CWE-639]).

Affected Products

Discourse versions prior to 2026.1.6
Discourse versions prior to 2026.5.2
Discourse versions prior to 2026.6.1 and 2026.7.0

Discovery Timeline

2026-08-10 - CVE-2026-72724 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72724

Vulnerability Analysis

The Discourse Chat plugin exposes a Onebox endpoint that renders previews for chat channels and threads. The handler parses a route containing both a channel_id and a thread_id. It then loads the channel and the thread as independent records before applying an authorization check limited to the channel.

Because the thread lookup is not scoped to the channel, an authenticated attacker can substitute a thread_id belonging to a private channel while supplying a channel_id for any channel they can preview. The Guardian#can_preview_chat_channel? check succeeds against the public channel, and the handler returns the private thread's message content in the Onebox response. This constitutes an Insecure Direct Object Reference ([CWE-639]).

Root Cause

The root cause is missing relational scoping between the channel and thread lookups. Authorization is enforced on the channel object, but the thread object is fetched globally by ID. Access to a permitted channel implicitly grants read access to any thread ID, regardless of the thread's actual parent channel.

Attack Vector

The attack requires network access and a valid authenticated session. An attacker enumerates or guesses thread_id values from private channels, then issues a /onebox.json request pairing that thread_id with a channel_id they are permitted to view. The response discloses the private thread's messages. No user interaction is required.

ruby

// Security patch in plugins/chat/lib/chat/onebox_handler.rb
        chat_channel = Chat::Channel.find_by(id: route[:channel_id])
        return if !chat_channel

-       thread = Chat::Thread.find_by(id: route[:thread_id]) if route[:thread_id]
+       thread = chat_channel.threads.find_by(id: route[:thread_id]) if route[:thread_id]
      end

      return if !Guardian.new.can_preview_chat_channel?(chat_channel)

Source: GitHub Commit 1276d7032a. The fix scopes the thread lookup to the resolved channel's threads association, ensuring the thread must belong to the authorized channel.

Detection Methods for CVE-2026-72724

Indicators of Compromise

Requests to /onebox.json containing chat channel and thread URL parameters where the thread_id does not belong to the referenced channel_id.
Bursts of Onebox requests from a single authenticated user iterating over sequential thread_id values.
Onebox responses returning thread content to users who have no membership in the thread's actual parent channel.

Detection Strategies

Parse Discourse application logs for /onebox.json requests and cross-reference the requesting user against the parent channel of the returned thread.
Alert when an authenticated user submits Onebox requests referencing chat threads at a rate inconsistent with normal browsing behavior.
Baseline expected Onebox usage per user role and flag deviations, especially requests targeting private or restricted channels.

Monitoring Recommendations

Enable verbose HTTP request logging on the Discourse web tier and forward logs to a centralized analytics platform.
Retain chat access audit trails long enough to reconstruct which threads each authenticated user retrieved via Onebox.
Correlate Onebox response payloads with channel membership records to identify unauthorized disclosure post-hoc.

How to Mitigate CVE-2026-72724

Immediate Actions Required

Upgrade Discourse to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 depending on the deployed release branch.
Review chat access logs since deployment of the vulnerable Chat plugin for anomalous Onebox activity.
Rotate or redact any sensitive information shared in private chat threads that may have been exposed.

Patch Information

The fix is delivered in pull requests #42091, #42092, #42093, and #42094, and documented in GitHub Security Advisory GHSA-8g98-fvfc-9w48. The corrective change in plugins/chat/lib/chat/onebox_handler.rb scopes the thread lookup to the resolved channel, replacing Chat::Thread.find_by(id: route[:thread_id]) with chat_channel.threads.find_by(id: route[:thread_id]).

Workarounds

Disable the Chat plugin until the upgrade is applied if immediate patching is not feasible.
Restrict Onebox rendering for chat URLs at the reverse proxy layer by blocking requests to /onebox.json referencing chat routes.
Limit chat channel and thread creation to trusted users to reduce the pool of enumerable private thread IDs.

bash

# Upgrade a standard Discourse container deployment
cd /var/discourse
git pull
./launcher rebuild app