{"id":"CVE-2026-24332","title":"Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with \"status\": …","summary":"Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with \"status\": …","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-204"],"vendor":"Discord","product":"WebSocket API service","affected":["websocket_api_service <= 2026-01-16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-01-22T15:10:52.267809Z"},"exploitAvailable":true,"published":"2026-01-22","updated":"2026-09-12","sourceUpdated":"2026-09-12T23:27:51.220Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-24332","references":[{"url":"https://xmrcat.org/discord-invisibility-bypass"}],"tags":["cve.org","exploit-available"],"epss":0.00293,"epssPercentile":0.22115,"exploits":{"github":2,"githubRepos":["https://github.com/WhiteTPoison100/Discord-CVE-2026-24332-demo","https://github.com/0cqb/CVE-2026-24332"],"checkedAt":"2026-09-23T07:13:55.750Z"},"ingestedAt":"2026-09-14T15:23:07.477Z","slug":"CVE-2026-24332","body":"## Overview\n\nDiscord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with \"status\": \"offline\"), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as \"You will appear offline.\" NOTE: a third-party report suggests that this was remediated later in 2026.\n\n## Affected\n\n- `websocket_api_service <= 2026-01-16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}