Vulnerability · Published Jan 22, 2026 · Assigned by mitre
CVE-2026-24332
Medium 4.3
In plain English
A medium-severity security flaw in WebSocket API service from Discord. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": "offline"), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as "You will appear offline." NOTE: a third-party report suggests that this was remediated later in 2026.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Discord | WebSocket API service | 0 – through 2026-01-16 |
Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N