CyberRota Analysis
AI-GeneratedThe vulnerability affects the Discourse open-source discussion platform, allowing authenticated users to exploit a flaw in the onebox_handler.rb file to access private thread messages by pairing a public channel ID with a private thread ID. This could lead to unauthorized disclosure of sensitive information within private chats. Organizations using affected versions should prioritize updating to versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.