CVE-2026-24332

Description

Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": "offline"), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as "You will appear offline."

PUBLISHED Reserved 2026-01-22 | Published 2026-01-22 | Updated 2026-01-22 | Assigner mitre

Problem types

CWE-204 Observable Response Discrepancy

Product status

References

xmrcat.org/discord-invisibility-bypass

cve.org (CVE-2026-24332)

nvd.nist.gov (CVE-2026-24332)

Download JSON