CVE-2026-72726
Discourse: Unauthorized eavesdropping on private AI bot conversations.
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
| CWE | CWE-200 |
| Vendor | discourse |
| Product | discourse |
| Published | Aug 10, 2026 |
| Last Updated | Aug 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for discourse discourse
Be the first to know when new medium vulnerabilities affecting discourse discourse are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
discourse / discourse
< 2026.1.6 >= 2026.5.0, < 2026.5.2 >= 2026.6.0, < 2026.6.1
References
github.com: https://github.com/discourse/discourse/security/advisories/GHSA-gw88-2jw8-jf2h github.com: https://github.com/discourse/discourse/commit/01faa889830f56e02fba2f6c1731811d319c5e81 github.com: https://github.com/discourse/discourse/commit/1fb2026eb8004dfeb12553014cc534dfd8083fbc github.com: https://github.com/discourse/discourse/commit/9247666f8359f3cf214b8aea3d396e8a8237ed38 github.com: https://github.com/discourse/discourse/commit/b56b98232aa4dad4a30500a65e31db0c9080c8f5