PT-2026-3920 · Discord · Discord

Xmrcat · Published 2026-01-22 · Updated 2026-01-22 · CVE-2026-24332

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discord versions through 2026-01-16

Description The software allows gathering information about whether a user’s client state is Invisible (and not actually offline). The response to a WebSocket API request includes the user in the presences array with a status of "offline," while truly offline users are omitted from this array. This behavior is inconsistent with the user interface description of Invisible, which states that users will appear offline. The issue involves the handling of user presence information via the WebSocket API. Specifically, the /presences API endpoint reveals the status of users who have set their status to Invisible. The status variable within the API response indicates whether a user is online, offline, idle, or do not disturb.

Recommendations Versions through 2026-01-16 should be updated when a fix becomes available.

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2026-24332

Affected Products

Discord

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-24332 · Security Note
• https://twitter.com/VulmonFeeds/status/2014287019254358089 · Twitter Post
• https://twitter.com/lsof/status/2014399262629454095 · Twitter Post
• https://twitter.com/CVEnew/status/2014253092309815310 · Twitter Post
• https://xmrcat.org/discord-invisibility-bypass · Note