CVE-2026-72726: Discourse Information Disclosure Flaw

CVE-2026-72726 Overview

CVE-2026-72726 is an information disclosure vulnerability in Discourse, an open-source discussion platform. Authenticated users can eavesdrop on private AI bot conversations through the AI bot reply stream. The flaw exists in the discourse-ai plugin, which failed to properly scope the reply stream to the private message (PM) participants. Any authenticated user subscribed to the stream could receive AI-generated content intended for other users' private conversations. The vulnerability is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. Discourse patched the issue in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Critical Impact
Authenticated users could intercept private AI bot reply streams, exposing confidential content shared with the AI assistant in private messages.

Affected Products

Discourse versions prior to 2026.1.6
Discourse versions prior to 2026.5.2 and 2026.6.1
Discourse versions prior to 2026.7.0 (with discourse-ai plugin enabled)

Discovery Timeline

2026-08-10 - CVE-2026-72726 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72726

Vulnerability Analysis

The vulnerability resides in the AI bot reply streaming logic within the discourse-ai plugin. Discourse streams AI bot replies in real time using a publish/subscribe mechanism. The stream publisher did not restrict subscribers to the participants of the underlying private message. Authenticated users who could subscribe to the reply channel received tokens from private conversations they were not party to. The disclosed data includes any content the AI bot generated in response to private prompts, which may include personally identifiable information, credentials pasted into prompts, or confidential business discussions.

Root Cause

The root cause is missing access control on the message bus channel used to publish AI bot reply tokens. In plugins/discourse-ai/lib/ai_bot/playground.rb, the streaming logic did not compute or enforce a set of allowed user IDs or group IDs for the reply channel. Without this scoping, the reply stream defaulted to broader visibility than the private message itself.

Attack Vector

An authenticated attacker subscribes to the AI bot reply stream channel using the Discourse message bus client. When any user initiates a private AI bot conversation, the attacker receives the streamed reply tokens in real time. Exploitation requires only a valid Discourse account and network access to the target instance. No user interaction from the victim is needed beyond initiating the AI bot conversation.

ruby

# Patch: plugins/discourse-ai/lib/ai_bot/playground.rb
# SECURITY: Scope AI bot reply stream to the PM's participants

        reply = +""
        post_streamer = nil
+       stream_user_ids = nil
+       stream_group_ids = nil

        post_type =
          (
# Source: https://github.com/discourse/discourse/commit/01faa889830f56e02fba2f6c1731811d319c5e81

The patch introduces stream_user_ids and stream_group_ids variables. These are later populated from the PM's participants and passed to the message bus publish call, restricting subscribers to authorized users.

Detection Methods for CVE-2026-72726

Indicators of Compromise

Unexpected subscriptions to AI bot reply channels from user accounts not participating in the associated private message
Anomalous message bus /discourse-ai/ai-bot/* channel traffic patterns from non-participant users
Web server access logs showing repeated long-polling requests to message bus endpoints from a single user across many distinct channels

Detection Strategies

Review Discourse message bus subscription logs for users subscribing to reply channels outside their private message participation
Correlate discourse-ai plugin version with the CVE-fixed releases across production instances
Audit UserApiKey and session activity for accounts making high volumes of message bus polling requests

Monitoring Recommendations

Enable verbose logging on the Discourse message bus and forward events to a centralized log platform
Alert on authenticated sessions polling AI bot reply channels while not appearing in the corresponding Topic.allowed_users list
Track deployment inventory to confirm all Discourse nodes run a patched version of the discourse-ai plugin

How to Mitigate CVE-2026-72726

Immediate Actions Required

Upgrade Discourse to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 depending on the current release branch
If upgrading is not immediately possible, disable the discourse-ai bot feature via site settings until the patch is applied
Rotate any credentials or secrets that users may have shared in AI bot private message conversations prior to patching

Patch Information

Discourse published fixes across four release branches. The patch scopes the AI bot reply stream to the private message participants by introducing stream_user_ids and stream_group_ids in plugins/discourse-ai/lib/ai_bot/playground.rb. Review the GitHub Security Advisory GHSA-gw88-2jw8-jf2h and the primary fix commit for details.

Workarounds

Disable the AI bot feature in the Discourse admin panel under the discourse-ai plugin settings
Restrict access to AI bot personas to a trusted group using the ai_bot_allowed_groups site setting until upgrade
Instruct users to avoid sharing sensitive data with the AI bot in private messages until the environment is fully patched

bash

# Verify installed Discourse version on the container host
cd /var/discourse
./launcher enter app
cat /var/www/discourse/VERSION

# Rebuild after updating app.yml to a patched Discourse version
./launcher rebuild app