Threats Tagged 'cve-2026-24332'

CVE-2026-24332 is a medium-severity vulnerability in Discord's WebSocket API service that allows an attacker to distinguish users who are Invisible from those who are truly offline. The issue arises because Invisible users appear in the presences array with a status of "offline," while offline users are omitted entirely. This discrepancy leaks information about user presence state contrary to the UI's claim that Invisible users appear offline. Exploitation requires network access and authenticated privileges but no user interaction. Although it does not impact confidentiality beyond presence state disclosure and does not affect integrity or availability, it can be used for user tracking or targeted social engineering. European organizations using Discord, especially those with high collaboration needs, should be aware of this privacy leak. Mitigations include monitoring API responses for unexpected presence data and advocating for Discord to patch the inconsistency. Countries with high Discord usage and active online communities, such as the UK, Germany, France, and the Netherlands, are most likely affected. The vulnerability has a CVSS score of 4.3, reflecting its limited but notable privacy impact.

MediumVulnerabilityGermanyFranceNetherlands+4#cve#cve-2026-24332#cwe-204