CVE-2026-72726

Executive Summary

CVE-2026-72726 is a broken access control vulnerability affecting Discourse, an open-source discussion platform. An authenticated user can successfully eavesdrop on private AI bot conversations via the AI bot reply stream, breaching the confidentiality guarantees of the platform's AI-powered features. The flaw impacts all Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The vulnerability allows an authenticated attacker to read private interactions, exposing sensitive information shared with AI bots to unauthorized parties, carrying a CVSS score of 6.5 (High). The issue is addressed in the fixed releases listed in the patch data. Patch confidence is rated as 2/4 (CLAIMED), indicating that the patch information originates from a single source (OSV) and has not been independently confirmed across multiple references.

Technical Analysis

The vulnerability falls under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The NVD description indicates that the flaw exists in the "AI bot reply stream," a mechanism used to stream responses from AI bots back to users in real time. The core issue is an authorization failure: an authenticated user who is not party to a given private conversation can subscribe to or observe the reply stream associated with that conversation, thereby eavesdropping on the exchange between the AI bot and the legitimate conversation participants.

Attack Surface and Mechanism:

The attack surface is the Discourse web application, specifically its WebSocket or real-time streaming infrastructure used to deliver AI bot responses. Because the threat model scenario requires authentication, the attack surface is restricted to legitimate platform users. However, confidentiality boundaries between users and between private conversation groups are not enforced on the streaming channel.

The vulnerability class here is Insecure Direct Object Reference (IDOR) or Broken Access Control combined with Information Exposure. When a client subscribes to the AI bot reply stream, the server apparently fails to verify that the subscribing user possesses the necessary permissions to view the conversation related to the stream. This likely stems from missing authorization checks on the stream channel name or stream subscription endpoint — the server validates that the user is authenticated (JWT, session cookie) but does not validate that the user is authorized to access the specific conversation resource from which the stream originates.

Insufficient technical detail is available regarding the exact implementation (function names, WebSocket channel identifiers, or API endpoint paths). The vulnerability analysis, therefore, is constrained to the vulnerability class and the described mechanism.

Delimiting Boundaries:

The vulnerability is limited to the AI bot reply stream and does not necessarily impact regular user-to-user messaging or other static content. The distinction is significant: the AI bot streaming feature evidently utilizes a different authorization pathway than the rest of the platform, and this separate pathway has the access-control omission.

The per-version patch mapping (2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0) suggests a patch might have been backported to multiple maintenance branches. The OSV package entry lists three distinct commit hashes (640840d818f4ee9375829ece0ef452923bb0c012, 06d03da34c4ed09ea59f917f045ba250d2b6320d, and an unreferenced root package) as affected; the fixed state is noted as those commits plus the numeric release versions.

Exploitation Scenarios

Target Identification (Reconnaissance): An attacker first identifies a Discourse instance running a vulnerable version (prior to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0). This is detectable via the "Discourse" theme, version indicators in the HTML source, or the /srv/status endpoint. After confirming the instance is vulnerable, the attacker creates or uses an existing account with authentication privileges. The attacker then identifies or monitors conversations where AI bots are active.

Flaw Triggering: The attacker subscribes to the AI bot reply stream for a conversation they do not belong to. Given the description, this could be a direct object reference (e.g., conversation ID) fed to the stream subscription mechanism of the AI bot reply feature, with the server failing to enforce access control. The attacker needs to know or enumerate the conversation identifier.

Execution Method: At the vulnerability-class level, the attacker authenticates and then issues a subscription request to the streaming endpoint for a private conversation containing an active AI bot. Because the authorization check is missing at this layer, the server grants access and begins forwarding AI bot reply events to the attacker. The payload is the subscription request itself; no code execution or injection is required. The attacker passively receives the streamed events.

Post-Exploitation Impact: The attacker captures AI bot replies in real time, exfiltrating whatever sensitive content is being generated in the context of the private conversation. If the conversation is ongoing, the attacker maintains a live feed of the AI responses. This could give the attacker insight into confidential business plans, customer data, internal deliberations, or credential-related material if the bot is used in operational contexts.

No public PoC is available, and no exploit code exists in public repositories at the time of analysis. The attack chain described above is inferred entirely from the vulnerability class and the NVD description. Attackers would likely adapt tooling to intercept WebSocket traffic in the Discourse client to automate the subscription.

Impact Assessment

• Confidentiality Impact: High (CVSS subscore) — Direct disclosure of AI bot conversation contents to an unauthorized authenticated user.
• Integrity Impact: None — The attacker cannot modify or inject data.
• Availability Impact: None — The service remains operational.
• Attack Complexity: Low — No specialist conditions are required beyond authentication.
• Attack Vector: Network — Fully network-exploitable via the application's standard HTTP/WebSocket interface.
• Privileges Required: Low — Any valid user account is sufficient, including low-privilege or restricted accounts.
• User Interaction: None — No victim action required.

Business Impact: For enterprises running Discourse for internal communications, this exposure could leak boardroom discussions, HR matters, legal consultation outputs, or product roadmap deliberations if AI bots (e.g., support, research, or drafting assistants) are in use. For public forums, the primary impact is on privacy expectations for premium, private, or restricted communities. The short-blip nature of the patch version spread (2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0) suggests rapid remediation is necessary, and the existence of multiple branch patches signals possibly widespread deployment of the vulnerable feature.

Blast Radius: Any Discourse instance that enables the AI bot feature. The vulnerability does not require the attacker to be a member of the targeted conversation, which significantly widens the reach. In multi-tenant deployments, a single authenticated user could pivot across all private conversations on the platform, as long as the conversation has an active AI bot.

The low EPSS score (0.00332) indicates that probability of exploitation in the wild is minimal at this time, but the vulnerability's characteristics (authentication requisite, specific feature dependency) likely contribute to the low score. This should not be misread as low impact; rather, the active exploitation trend is low because of the feature-specific nature.

Detection Guidance

The signature of this vulnerability is a stream subscription to a conversation identifier without the prerequisite permission. Detection should focus on WebSocket/SSE traffic patterns, access logs, and application-layer events.

Sigma Rule

title: Discourse AI Bot Conversation Stream Unauthorized Access
id: a3c55c28-0f01-4a94-8e9e-dcfc83f13f42
status: experimental
description: Detects subscription to Discourse AI bot conversation streams from unprivileged users, indicating CVE-2026-72726 exploitation attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72726
author: Valters IT Threat Intel
date: 2026/02/17
logsource:
    product: discourse
    service: web
detection:
    selection:
        # activity on the AI bot reply stream message
        channel|contains: "ai_bot"
        # stream joining or message subscription event
        event_type|startswith: "subscribe"
    filter:
        # verify that the request originates from an inappropriate context
        # A core heuristic: the user is not a participant of the conversation ID
        conversation_membership: "missing"
    condition: selection and filter
level: high
falsepositives:
    - Legitimate AI bot stream subscriptions by participants or admins
    - Feature updates where conversation schemas are migrated
tags:
    - attack.t1557
    - attack.t1190
    - cve.2026.72726

YARA Rule

rule discourse_ai_bot_stream_unauthorized
{
    meta:
        author = "Valters IT Threat Intel"
        date = "2026-02-17"
        description = "Detects hidden stream subscription packets targeting the AI bot stream with conversation identifiers"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72726"
        cve = "CVE-2026-72726"
    strings:
        $s1 = "ai" ascii nocase
        $s2 = "stream" ascii nocase
        $s3 = "bot" ascii nocase
        $s4 = "conversation" ascii nocase
        $s5 = "access_token" ascii nocase
    condition:
        # Represents a network capture of a subscription attempt to a stream channel.
        # The combination of keywords above can indicate the attacker referencing the private channel.
        all of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Discourse AI Bot Stream Unauthorized Subscription (CVE-2026-72726)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/"; http.accept; content:"text/event-stream"; http.header; content:"Authorization"; http.header; content:"Bearer"; http.header; content:"Discourse"; classtype:attempted-recon; reference:cve,2026-72726; sid:729260; rev:1; metadata:created_at 2026_02_17, updated_at 2026_02_17;)

Note: Because the exact channel path is not disclosed in the NVD description, this Suricata rule is built on the presence of text/event-stream (SSE) alongside authentication headers — this is a broad framing to catch any stream-based exfiltration attempts. Adjust the URI patterns based on local implementation once vendor advisory is available.

Elastic Detection

# EQL query for indexed web server logs (Elastic Common Schema)
sequence by source.ip
    with maxspan=5m
    [ http where http.request.method == "GET" and
        url.path in ("/srv/stream", "/tracking") and
        user_agent.name == "Discourse" and
        // Ensure authentication context exists
        source.ip != "127.0.0.1" ]
    [ http where http.request.method == "GET" and
        url.path ~= ".*(bot|ai).*" and
        // no prior authorization for that conversation
        not (behavior: "authorized") ]

Note: This EQL is intentionally generic due to lack of code-level channel names.

Splunk SPL Query

index=web sourcetype=access_combined
| rex field=_raw "(?<method>\w+) (?<uri>/\S*)" 
| search uri="*bot*" OR uri="*ai*" 
| rename src_ip as src
| lookup categories.csv src AS src OUTPUT category
| join type=inner src [search index=web earliest=-15d | stats values(user) as known_users by src]
| stats count by src, uri, status
| where status=200 AND count > 1

Wazuh OSSEC Rule

<group name="discourse, cve,">
  <rule id="100278" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*ai\.|\.*bot\.*</field>
    <field name="message">subscribe</field>
    <description>Discourse Unauthorized AI Bot Stream Access Attempt</description>
    <group>discourse_ai_bot,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED). The patch information is sourced from a single reference (OSV). It is recommended that security teams verify the fix by applying the updates and conducting application-level authorization testing before relying solely on this patch data.

1. Immediate Mitigations (until patched):

• Disable the AI Bot feature if not strictly required for business continuity. This eliminates the affected attack surface.
• Enforce strict network segmentation to restrict access to the Discourse application from untrusted networks; limit exposure to only internal, trusted clients to lower the viable assessability.
• Review user accounts and disable dormant/stale accounts that are not actively used, reducing the population of potential low-privilege attackers.
• Monitor logs for anomalous stream-subscription events, especially from users unfamiliar with AI bot conversations.

2. Patch/Upgrade Steps:

• Upgrade Discourse to a fixed version: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 (select based on the current release branch in use for your instance).
• After upgrading, test the AI bot feature to confirm that a non-participant user is now denied subscription — validating that the authorization check is operating as expected.
• Check the upstream Discourse GitHub release notes for the version you apply to confirm the fix is present; given patch confidence 2/4, the OSV data alone is insufficient for a green-light without application-layer verification.

3. Long-Term Hardening:

• Implement application-layer authorization checks as a standard part of the streaming infrastructure. Ensure that every server push (WebSocket/SSE) validates that the authenticated principal is a member of the resource (conversation) and has the read permission for that resource.
• Follow the OWASP ASVS guidelines for broken access control testing and ensure authenticated testing scenarios include negative cases for multi-tenancy data isolation.
• Integrate threat modeling for new features (AI integration, streaming) in the development lifecycle — in particular, call out real-time channels as separate attack surfaces that need their own security review.
• Enable and maintain central logging of authorization decisions and subscriptions so that forensic analysis is possible in the event of suspicion.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72726
2. OSV Vulnerability Entry (patch source): https://osv.dev/vulnerability/CVE-2026-72726
3. Discourse Official Site (for version information): https://www.discourse.org/
4. MITRE ATT&CK Technique mapping: https://attack.mitre.org/techniques/T1557/
5. CWE-200 Definition: https://cwe.mitre.org/data/definitions/200.html

Threat Actor Activity: No evidence of in-the-wild exploitation exists at this time. CISA KEV does not list this CVE. No threat actor campaigns have been publicly attributed to this vulnerability. The low EPSS score (0.00332) corroborates the absence of observed exploitation.