CVE-2026-24332

Executive Summary

CVE-2026-24332 is an information disclosure vulnerability in the Discord WebSocket API that allows any authenticated client to determine whether a target user operates in "Invisible" presence mode. The flaw stems from an inconsistency in API response construction: users with the Invisible status are included in the presences array with "status": "offline", whereas genuinely offline users are entirely omitted from this array. This enables a remote attacker to bypass the privacy guarantee of Invisible mode, gathering real-time online/offline intelligence about targeted users. The vulnerability requires only a standard Discord client or scripted WebSocket connection, carries a CVSS score of 4.3 (Medium), and is currently unpatched as of 2026-01-16.

Technical Analysis

The Discord WebSocket API uses a presence-based event model where client state is synchronized through a structured payload. Under normal operation, the presences array within gateway dispatch events (specifically PRESENCE_UPDATE and the initial READY/GUILD_CREATE payloads) contains presence objects for all users the client has visibility into. Each presence object includes a user object and a status field that enumerates online, idle, dnd, or offline.

The vulnerability arises from an asymmetry in how Discord's backend aggregates presence data:

• Genuinely offline users (those who closed the client or lost connectivity) are dropped entirely from the presences array. No entry exists for them.
• Users in Invisible mode (UI setting "You will appear offline") are still included in the presences array, but with a status field hardcoded to "offline".

This data-modeling discrepancy means that a client that receives a GUILD_CREATE or PRESENCE_UPDATE event can detect the presence of an "offline" user in the array and confidently conclude that the user is actually online in Invisible mode. The malicious client never receives a presence entry for truly offline users, making the distinction unambiguous.

The attack surface is the WebSocket gateway endpoint (wss://gateway.discord.gg/?v=10&encoding=json), which requires only a valid authentication token — obtainable via a standard user login or by creating a bot token. No elevated privileges, no administrator access, and no user interaction are required. The attacker only needs to be in a mutual server (guild) with the target, or share a direct message channel. The impact is purely confidentiality: the attacker gains verified real-time presence intelligence that the victim explicitly attempted to hide.

The vulnerability is inherent to the backend API's JSON serialization logic and is not caused by a client-side parsing flaw. Discord's frontend correctly renders Invisible users as offline, but the underlying data layer leaks the presence marker. The issue was publicly documented on 2026-01-16 via an NVD entry, but no patch, advisory, or timeline for remediation has been published by Discord as of the writing of this report.

Exploitation Scenarios

The following attack chain demonstrates how a determined individual — a stalker, rival, or moderator — can exploit CVE-2026-24332 to track a victim's true online status:

1. Reconnaissance & Target Identification
   The attacker creates a standard Discord account (or uses an existing one) and gains access to a shared server with the target. The target's user ID is enumerated via the GET /users/{id} endpoint using the client's self-token. Alternatively, the attacker can simply observe a server member list if already co-resident.

2. WebSocket Session Establishment
   The attacker opens a WebSocket connection to the Discord gateway:

   wss://gateway.discord.gg/?v=10&encoding=json
   

   After the initial handshake, the attacker sends an IDENTIFY payload with their authentication token, specifying presence with "status": "online". Guild subscriptions are requested by setting guild_subscriptions: true in the IDENTIFY payload.

3. Presence Array Harvesting
   Upon successful identification, Discord dispatches READY and then GUILD_CREATE events for each guild the attacker belongs to. Each GUILD_CREATE includes a presences array. The attacker parses each entry, extracting all user objects where status == "offline". Critically, users who are truly offline do not appear in this array at all. Thus, every user present in the array with status: "offline" is flagged as suspicious.

4. Verification via Delta Observation
   To eliminate false positives (e.g., users who briefly appear due to gateway quirks), the attacker opens a second WebSocket connection and captures a baseline snapshot. They then wait 10–15 minutes and compare the two snapshots. A user who remains persistently present with status: "offline" across multiple snapshots — while not being deleted from the array — confirms they are in Invisible mode. A truly offline user would never appear in the array in either snapshot.

5. Real-Time Activity Tracking
   The attacker keeps the WebSocket connection open and listens for PRESENCE_UPDATE events. Whenever the target transitions from Invisible (status: "offline" with a presence entry) to Visible (status: "online", "idle", or "dnd"), the attacker receives a delta event. By logging these transitions, the attacker builds a behavioral profile: hours of activity, reaction patterns to server events, and periods of true offline state.

6. Post-Exploitation Impact
   The attacker uses the gathered intelligence for social engineering (timing messages when the victim is active), stalking (confirming the victim is online while claiming to be away), or operational security compromises (e.g., in community disputes, determining when a rival moderator is actually present to evade detection).

The exploitation requires no malicious payloads, no privilege escalation, and no interaction with the target. It is a purely passive, read-only API abuse that can be scripted in fewer than 100 lines of Python using the websocket-client library.

Impact Assessment

Business Impact: For enterprise environments where Discord is used for internal communication (through Discord's Nitro for Business or community servers), this vulnerability collapses the operational security of employees who intentionally use Invisible mode to avoid distractions or signal availability. An attacker with a valid account in the same server can silently monitor the real presence of staff, enabling targeted phishing, social engineering, or insider threat profiling.

CVSS Breakdown (Score: 4.3, Medium): The confidentiality impact is partial (C:P) — the attacker learns boolean presence information. Integrity (I:N) and availability (A:N) are unaffected. The attack requires no user interaction and no special privileges beyond standard authentication, but it does require co-membership in a shared guild or direct-message channel — hence the moderate score.

Affected Systems: All Discord clients through 2026-01-16 that connect to the WebSocket gateway. This includes desktop, mobile, web, and the open-source client variants (e.g., BetterDiscord, Vencord) that proxy or directly interface with the gateway. Any server that hosts a Discord bot with GUILD_PRESENCES intent is also affected, as bot operators can write a script to detect Invisible-mode users at scale.

Blast Radius: The vulnerability affects every public and private Discord server globally. Given Discord's reported 200+ million monthly active users, the potential victim pool is substantial. The exploitation is trivially automatable at scale: a bot operator can scan all members of every guild they join, building a global map of users' true online statuses.

Detection Guidance

The following detection rules assume an environment where Discord gateway traffic is either proxied (e.g., a corporate egress proxy logging WebSocket frames) or where host-based logging of Discord client processes is enabled. Since the vulnerability is API-level, detection focuses on anomalous presence-abuse patterns.

Sigma Rule

title: Discord Invisible Presence Enumeration via WebSocket
id: 8f7a3c2e-5a1b-4d6c-9e2f-3a8b5c7d1e0f
status: experimental
description: Detects scripts that repeatedly open Discord WebSocket connections and log presence arrays, indicating possible exploitation of CVE-2026-24332.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-24332
author: Valtersit Threat Intelligence
date: 2026/01/20
tags:
    - attack.t1593
    - attack.collection
    - cve.2026.24332
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\python.exe'
            - '\node.exe'
        CommandLine|contains:
            - 'gateway.discord.gg'
            - 'websocket'
            - 'presences'
    condition: selection
falsepositives:
    - Legitimate Discord bots using presence-gathering features
level: medium

YARA Rule

rule Discord_Invisible_Presence_Enum
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects scripts that parse Discord WebSocket presence arrays to identify Invisible users"
        cve = "CVE-2026-24332"
        date = "2026-01-20"
    strings:
        $s1 = "gateway.discord.gg" ascii wide
        $s2 = "presences" ascii wide
        $s3 = "\"status\": \"offline\"" ascii wide
        $s4 = "PRESENCE_UPDATE" ascii wide
        $s5 = "GUILD_CREATE" ascii wide
        $s6 = "wss://" ascii wide
        $s7 = "IDENTIFY" ascii wide
    condition:
        4 of them
}

Suricata IDS Rule

alert tcp any any -> any 443 (msg:"Discord CVE-2026-24332 Invisible Presence Probe"; flow:to_server,established; content:"gateway.discord.gg"; nocase; content:"IDENTIFY"; nocase; content:"presences"; nocase; content:"status"; nocase; content:"offline"; nocase; threshold:type both, track by_src, count 5, seconds 60; sid:202624332; rev:1; metadata:created_at 2026_01_20, cve CVE-2026-24332;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.type == "start" and process.name in ("python.exe", "node.exe") and
     process.command_line contains "gateway.discord.gg"]
  [network where process.name in ("python.exe", "node.exe") and
     destination.port == 443 and network.protocol == "tls" and
     dns.question.name : "gateway.discord.gg*"]

Splunk SPL Query

index=proxy sourcetype="stream:websocket"
| search "gateway.discord.gg" AND "IDENTIFY"
| stats count, values(_raw) as payload by src_ip, dest_ip, user
| where count > 5
| eval suspicious = if(match(payload, "presences.*offline"), "yes", "no")
| where suspicious == "yes"
| table _time, src_ip, user, count

Wazuh OSSEC Rule

<group name="discord_presence_enum,">
  <rule id="100243" level="8" frequency="5" timeframe="60">
    <if_sid>100000</if_sid>
    <field name="command">\.*gateway\.discord\.gg\.*</field>
    <field name="command">\.*presences\.*</field>
    <description>Discord WebSocket presence enumeration tool detected (CVE-2026-24332)</description>
    <group>discord,privacy_violation,</group>
    <mitre>
      <id>T1593</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: Unpatched. CVE-2026-24332 has a 0/4 patch confidence rating — no vendor fix, no confirmed patched version, and no CVE database entry list any affected or fixed version. Discord has not publicly acknowledged the issue or provided a remediation timeline.

Immediate Mitigations (until vendor fix):

1. Do not rely on Invisible mode for security-sensitive activity. Treat the Invisible status as cosmetic, not a privacy boundary. Assume anyone in your servers can determine your true online status.
2. For enterprise users: If Discord is used for sensitive coordination, require staff to log out of Discord entirely when they should be "unavailable." Invisible mode does not provide this guarantee.
3. Server administrators: Restrict bot joins to trusted developers only. A malicious bot with GUILD_PRESENCES intent can silently enumerate presence at scale. Audit existing bots for presence-reading capabilities.
4. Client-side workaround: Do not use Invisible mode on the same device as your primary account if you operate a secondary "ghost" account — the two presences can be correlated.

Patch/Upgrade Steps:

• As of the report date, there is no patched version to upgrade to. Monitor Discord's official changelog and security advisories at https://discord.com/security-disclosure and https://support.discord.com/hc/en-us/sections/360001475291. When a fix is released, the mitigation will likely be a server-side change requiring no client update — the backend will stop including Invisible users in the presences array.
• If the fix is client-side (unlikely), apply the latest Discord client update immediately upon release.

Long-Term Hardening:

• Advocate for platform-level fix: Submit pressure via Discord's bug bounty program (HackerOne) to accelerate remediations. Reference CVE-2026-24332 and the inconsistency with the documented UI behavior.
• For security researchers: Track CVE-Record (cve.org) for updates. If you operate a private presence-monitoring defense, implement detection rules above to flag internal abuse.
• For developers of Discord libraries: Consider patching your library to explicitly filter or mark Invisible-status entries, reducing accidental information leakage in your own applications.
• Enterprise policy: If your organization's threat model treats "appearing offline" as a protective measure (e.g., against stalking), document a formal risk acceptance until the fix is deployed. Consider social-engineering awareness training that explicitly warns employees that Discord Invisible mode is not a true offline state.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-24332
2. Discord Security Disclosure Policy: https://discord.com/security-disclosure
3. Discord Bug Bounty Program (HackerOne): https://hackerone.com/discord
4. MITRE ATT&CK Technique T1593 — Active Scanning (recon for attack surface): https://attack.mitre.org/techniques/T1593/
5. EPSS Data Feed (FIRST.org) confirming low exploitation probability: https://www.first.org/epss/data_stats

Threat Actor Activity Note: As of 2026-01-20, there is no documented evidence of weaponized exploit-in-the-wild campaigns, and the CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00260 (17.6th percentile) suggests a low immediate exploitation likelihood; however, the low technical barrier to exploitation (a ~50-line script) and the privacy-sensitive use case make this a candidate for rapid, organic adoption by cyber-stalking and OSINT communities after wider publicization.