CVE-2026-24332: Medium severity Discord Discord vulnerability
Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": "offline"), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as "You will appear offline."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24332?
CVE-2026-24332 is classified as a medium severity vulnerability due to its potential for privacy invasion.
How do I fix CVE-2026-24332?
To mitigate CVE-2026-24332, users should update to the latest version of Discord beyond 2026-01-16.
Can CVE-2026-24332 be exploited to disclose user information?
Yes, CVE-2026-24332 can be exploited to infer user presence information which may lead to privacy concerns.
What versions of Discord are affected by CVE-2026-24332?
CVE-2026-24332 affects all versions of Discord up to and including 2026-01-16.
Is there a workaround for CVE-2026-24332?
There are no known workarounds for CVE-2026-24332; upgrading is the recommended solution.