CVE-2026-72724

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0

Description An authenticated user can obtain private thread message content by pairing a public channel ID with a private thread ID in a /onebox.json request. This occurs because the plugins/chat/lib/chat/onebox handler.rb file resolves Chat::Thread using the route thread id independently of the route channel id before verifying if the user has permission to preview the selected chat channel.

Recommendations Update to version 2026.1.6. Update to version 2026.5.2. Update to version 2026.6.1. Update to version 2026.7.0.