Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-10T16:19:50.097Z",
  "pubdate": "2026-08-10T16:19:50.097Z",
  "executiveSummary": "An information disclosure vulnerability exists in the Discourse discussion platform affecting versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The vulnerability allows an authenticated user to eavesdrop on private AI bot conversations by intercepting the AI bot reply stream.\nThe flaw impacts the confidentiality of automated interactions within the platform, enabling unauthorized users to access sensitive or private dialogue content meant exclusively for other participants. Exploitation requires authenticated access to the platform and the ability to monitor network or application streams associated with AI bot replies.\nThe risk implication is a breach of user privacy and potential exposure of confidential data processed via integrated artificial intelligence features. The issue has been addressed by the vendor in the specified patched releases.",
  "technicalDetails": "The root cause of the vulnerability stems from improper access control enforcement within the AI bot reply stream handling logic of Discourse. Specifically, the application fails to adequately validate whether the requesting authenticated user possesses the appropriate authorization to view responses generated during private AI bot interactions.\nAuthentication requirements dictate that the attacker must possess a valid, authenticated user session on the target Discourse instance. However, elevated administrative privileges are not strictly necessary, as standard authenticated users can exploit the authorization bypass.\nThe attack flow proceeds as follows: an authenticated user initiates or monitors network and application communication channels while private AI bot conversations are taking place. Due to the lack of strict entitlement checks on the reply stream component, the vulnerable endpoint broadcasts or permits subscription to the streaming response data of private interactions. Consequently, the unauthorized user can passively eavesdrop on the real-time reply stream, capturing sensitive data, context, and prompts exchanged between the AI bot and other users.\nThe vulnerable component resides within the AI bot integration and streaming response modules of the Discourse platform. Affected versions include all deployments prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.\nPost-exploitation impact is limited to the unauthorized disclosure of conversational data, potentially leaking intellectual property, personal identifiable information (PII), or internal organizational secrets handled through the AI bot interface."
}