CVE-2026-72724

Executive Summary

CVE-2026-72724 is an authorization-bypass vulnerability (CWE-639) in Discourse, the open-source discussion platform, affecting the chat plugin's onebox message-preview handler. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and retrieve the message content of a private chat thread to which they should not have access. The issue is fixed in Discourse 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0; no public exploit, CISA KEV listing, or independent patch confirmation currently exists.

Technical Analysis

The vulnerability resides in the file plugins/chat/lib/chat/onebox_handler.rb, the handler that renders onebox previews for Discourse Chat. The NVD description states that the handler "resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel."

Mechanically, this is an object-level authorization failure, classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The route contains two user-controlled identifiers: channel_id (identifying a chat channel) and thread_id (identifying a chat thread). Expected behavior is that access to a thread is gated by the visibility of the channel that contains it: a user may preview content only if they can preview the parent channel. In the vulnerable implementation, the handler resolves the thread using thread_id first and independently — it does not verify that the resolved thread actually belongs to the channel identified by channel_id, nor does it bind the authorization decision to the thread's real parent channel.

The authorization check that is eventually performed ("whether the user can preview the selected chat channel") is evaluated against the channel supplied in the request, not against the channel that actually owns the resolved thread. An authenticated attacker can therefore supply the channel_id of a public channel they are allowed to preview, pair it with the thread_id of a private thread from a restricted channel, and pass the preview authorization check. The handler then returns the private thread's message content to the user.

The affected versions are all Discourse releases prior to 2026.1.6 in the 2026.1 maintenance branch, prior to 2026.5.2 in the 2026.5 branch, prior to 2026.6.1 in the 2026.6 branch, and prior to 2026.7.0 in the 2026.7 branch. The NVD entry does not enumerate a complete affected-version list; the OSV package entry marks the vulnerability as unfixed at commit 0, 640840d818f4ee9375829ece0ef452923bb0c012, and 06d03da34c4ed09ea59f917f045ba250d2b6320d, confirming that no full affected-range data was published at the time of analysis.

The attack surface is the /onebox.json endpoint, which is reachable over the network by any authenticated user. The vulnerability requires low privileges (a valid account on the target Discourse instance), no user interaction, and low attack complexity. The confidentiality impact is low per the CVSS vector — the leaked content is limited to private chat thread messages, not full account or system compromise. There is no integrity or availability impact.

Additional technical detail, such as the exact request parameter names beyond channel_id and thread_id, the response format, or the precise code flow inside onebox_handler.rb, is not available in the NVD description. Analysts should treat the description's file path and route parameters as the only confirmed implementation details.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available for CVE-2026-72724. The attack chain below is inferred strictly from the vulnerability class (CWE-639, IDOR via unrelated user-controlled keys) and the confirmed facts in the NVD description.

1. Reconnaissance / target identification. The attacker authenticates to a Discourse instance running a vulnerable version of the chat plugin (any release before 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 in the matching branch). As an authenticated user, they enumerate public channel_id values — these are visible to any logged-in user through normal channel browsing. Private thread_id values may be obtained by observing IDs in shared URLs, browser history, server logs, or other users' messages that inadvertently reference a thread.

2. Triggering the flaw. The attacker crafts an HTTP request to the /onebox.json endpoint that includes both route parameters: the channel_id of a public channel and the thread_id of a private thread. The handler resolves the Chat::Thread from thread_id without confirming that this thread belongs to the supplied channel_id or to a channel the attacker is permitted to view.

3. Payload / execution method. No injection-style payload is involved. The vulnerability is triggered purely by parameter manipulation: submitting mismatched object identifiers in a single authenticated request. Because the authorization gate checks preview rights on the supplied (public) channel rather than on the actual parent channel of the resolved thread, the attacker's request passes the check. This is the essence of CWE-639 — the authorization decision trusts a user-controlled key without verifying object ownership or parent-child binding.

4. Post-exploitation impact. The attacker receives the message content of the private thread in the onebox response. By iterating over multiple thread_id values, the attacker can enumerate and exfiltrate the contents of many private chat threads, including threads from channels to which they have no access. Because the affected operation is read-only, the impact is limited to unauthorized disclosure of private discussion content; there is no data modification, account takeover, or denial-of-service component.

Impact Assessment

The CVSS score is 4.3 (Medium) under vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Sub-score analysis: the attack is network-exploitable (AV:N) with low complexity (AC:L), requires a valid low-privileged account (PR:L), and needs no user interaction (UI:N). The scope is unchanged (S:U), and the only affected security property is confidentiality at a low level (C:L). Integrity and availability are unaffected.

Business impact depends on the sensitivity of the content hosted in Discourse Chat. Enterprise deployments often use Discourse for internal communication, vendor support, or community management; private threads can contain non-public releases, incident response discussion, customer data, or internal organizational details. Unauthorized disclosure of this content to any authenticated community member (who may be a customer, partner, or external party registered on the platform) could lead to information leakage, regulatory concerns around PII, and erosion of trust.

Blast radius: any Discourse instance using the built-in chat plugin and onebox feature prior to the fixed versions. This includes both self-hosted and managed deployments. The requirement for an authenticated account reduces the attack population, and the need to know private thread_id values (or enumerate them) further lowers practical risk. EPSS scores this at 0.00324 (25.2 percentile of exploited CVEs), indicating a low current likelihood of exploitation in the wild. The CVE is not listed in CISA KEV, and there are no known threat-actor campaigns or exploit-in-the-wild evidence at the time of writing.

Detection Guidance

Detection should focus on anomalous use of the /onebox.json endpoint — particularly requests that pair channel_id and thread_id parameters from the same client or user in high volume, since legitimate onebox previews are user-initiated and low-frequency compared to enumeration behavior. Separately, monitoring of the application source file path can identify vulnerable copies of the Discourse chat plugin during software-asset scanning.

Sigma Rule

title: Potential Discourse Chat Onebox Authorization Bypass Enumeration (CVE-2026-72724)
status: experimental
description: >
  Detects repeated requests to /onebox.json containing both channel_id and
  thread_id parameters, which may indicate enumeration of private chat threads
  via a public channel ID (CWE-639).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-72724
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.72724
  - cwe.639
logsource:
  category: webserver
  product: null
  definition: 'Adjust product to match the deployed web server (nginx, apache, etc.).'
detection:
  selection:
    cs-uri-path:
      - '/onebox.json'
    cs-uri-query|contains|all:
      - 'thread_id='
      - 'channel_id='
  condition: selection
timeframe: 5m
fields:
  - clientip
  - cs-username
  - cs-uri-query
falsepositives:
  - Legitimate onebox previews of threads the user is authorized to view
level: medium

YARA Rule

rule Discourse_Chat_Onebox_Auth_ByPass_CVE_2026_72724 {
    meta:
        author = "Valters IT Security Team"
        description = "Detects vulnerable Discourse chat onebox handler source code or web access log evidence of CVE-2026-72724 exploitation"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72724"
        cve = "CVE-2026-72724"
        date = "2026-01-01"
    strings:
        $s_handler = "plugins/chat/lib/chat/onebox_handler.rb"
        $s_endpoint = "/onebox.json"
        $s_thread   = "thread_id"
        $s_channel  = "channel_id"
        $s_route    = "Chat::Thread"
    condition:
        (uint16(0) == 0x5A4D and $s_handler and $s_route) or
        ($s_endpoint and $s_thread and $s_channel)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Discourse onebox.json thread_id/channel_id enumeration attempt (CVE-2026-72724)"; flow:established,to_server; http.uri; content:"/onebox.json"; http.uri; content:"thread_id"; http.uri; content:"channel_id"; within:250; threshold:type both, track by_src, count 20, seconds 60; metadata:cve CVE-2026-72724; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-72724; classtype:attempted-recon; sid:20372724; rev:1;)

Elastic Detection

sequence by user.name with maxspan=15m
  [ any where url.path == "/onebox.json"
        and wildcard(url.query, "*thread_id=*")
        and wildcard(url.query, "*channel_id=*") ] with runs = 20

This EQL sequence fires when the same authenticated user makes 20 or more /onebox.json requests carrying both thread_id and channel_id parameters within a 15-minute window — a strong indicator of thread enumeration. A complementary single-event filter can be used for lower thresholds or audit purposes:

any where url.path == "/onebox.json"
  and wildcard(url.query, "*thread_id=*")
  and wildcard(url.query, "*channel_id=*")

Splunk SPL Query

index=* sourcetype=access_combined
  uri_path="/onebox.json"
  uri_query="*thread_id=*" uri_query="*channel_id=*"
| stats earliest(_time) as first_seen, latest(_time) as last_seen,
        dc(uri_query) as distinct_queries, values(uri_query) as uris,
        count as request_count by src_ip, user
| where request_count > 20 OR distinct_queries > 20
| table _time, user, src_ip, request_count, distinct_queries, first_seen, last_seen, uris

Wazuh OSSEC Rule

<rule id="100274" level="6" frequency="15" timeframe="120" ignore="60">
  <decoded_as>web-accesslog</decoded_as>
  <regex type="pcre2">/onebox\.json\?.*(?:thread_id|channel_id)=</regex>
  <description>Possible Discourse chat onebox parameter enumeration (CVE-2026-72724)</description>
  <group>web_application_attacks,authorization,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence is 2/4 — CLAIMED. The fix is reported by a single source (OSV) and has not been independently confirmed against vendor advisories. The NVD entry lists fixed versions but no vendor-provided advisory URL or commit hash. Validate all patching steps against the upstream Discourse release notes before deploying.

1. Immediate mitigations. Monitor and, if operationally feasible, temporarily restrict access to the /onebox.json endpoint through a web application firewall or reverse-proxy allowlist until patching is complete. Audit existing access logs for patterns matching the Sigma/Splunk detections above, prioritizing authenticated users with a high volume of onebox requests. Restrict the chat plugin and onebox feature to the smallest group of roles that require them, as a defense-in-depth measure.

2. Patch / upgrade steps. Upgrade Discourse as follows: the 2026.1 branch to version 2026.1.6 or later; the 2026.5 branch to 2026.5.2 or later; the 2026.6 branch to 2026.6.1 or later; and the 2026.7 branch to 2026.7.0 or later. Before upgrading, check the official Discourse repository and release announcements for confirmation, since the patch is only claimed by a single source at this time. After upgrade, verify that the chat plugin's onebox handler is no longer resolving thread_id independently of channel_id before the channel-preview authorization check.

3. Long-term hardening. Enforce object-level authorization in application code: any route that receives both a parent object ID (channel_id) and a child object ID (thread_id) must verify that the child belongs to the supplied parent, and the authorization check must be evaluated against the actual parent object of the resolved child. Add regression tests that attempt mismatched parent/child ID pairs against the onebox handler. Subscribe to Discourse security advisories and the OSV feed for this package. Maintain current backups and a rapid upgrade path for future security releases.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-72724
2. OSV Vulnerability Record — https://osv.dev/vulnerability/CVE-2026-72724
3. Discourse Project Security Advisories — https://github.com/discourse/discourse/security/advisories
4. CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat-actor campaigns or exploit-in-the-wild evidence exists for CVE-2026-72724 at the time of writing. The CVE is not listed in the CISA KEV catalog, no public PoC or Nuclei template has been identified, and the EPSS score (0.00324) places it in the 25.2 percentile of exploited CVEs, indicating low current exploitation activity.