Description
Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": "offline"), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as "You will appear offline."
INFO
Published Date :
2026-01-22T08:10:44.462Z
Last Modified :
2026-01-22T15:11:05.705Z
Source :
mitre
AFFECTED PRODUCTS
The following products are affected by CVE-2026-24332 vulnerability.
| Vendors | Products |
|---|---|
| Discord |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-24332.
| URL | Resource |
|---|---|
| https://xmrcat.org/discord-invisibility-bypass |
|
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact