Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before checking whether the user can preview the selected chat channel. An authenticated user can pair a public channel ID with a private thread ID in a /onebox.json request and obtain private thread message content. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-10T16:19:49.810Z",
  "pubdate": "2026-08-10T16:19:49.810Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the chat plugin of Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The vulnerability arises from improper access control validation during onebox processing, where a chat thread is resolved independently of its parent channel permissions.\nAn authenticated attacker with standard privileges can exploit this flaw by issuing a crafted /onebox.json request that pairs a public channel ID with a private thread ID. This forces the application to bypass standard preview restriction checks and disclose sensitive message content from private chat threads to unauthorized users.\nThe risk implication is a breach of confidentiality within the chat subsystem, allowing unauthorized extraction of private communications. Exploitation requires standard user authentication on the target Discourse instance and network access to the chat onebox endpoint.",
  "technicalDetails": "The root cause of the vulnerability resides in the plugins/chat/lib/chat/onebox_handler.rb component within the Discourse chat plugin. When processing requests, the handler resolves the Chat::Thread entity using the route thread_id parameter independently of the corresponding route channel_id.\nCrucially, this lookup occurs before the application verifies whether the requesting user possesses the necessary privileges to preview or access the selected chat channel. Consequently, if an attacker supplies a mismatched parameter set—specifically, a public channel ID combined with a private thread ID—the underlying logic fails to enforce proper authorization boundaries.\nThe attack flow proceeds as follows: 1) The attacker identifies or possesses a valid user session on the target Discourse instance, satisfying the authentication requirement. 2) The attacker constructs an HTTP request targeting the /onebox.json endpoint. 3) Within the request parameters, the attacker supplies a public channel ID alongside the targeted private thread ID. 4) The vulnerable onebox_handler.rb script processes the thread resolution step without validating the user's access rights to the private context. 5) The application generates a onebox preview containing the private thread message content and returns it in the HTTP response, thereby completing the unauthorized data disclosure."
}