CVE-2026-24332

CVE-2026-24332 – Discord 隐身模式在线状态泄露 摘要 本仓库记录了 CVE-2026-24332，这是一个影响 Discord 客户端和 API 的未修复隐私问题。 该漏洞允许外部客户端判断被标记为 Invisible （隐身）的用户是否实际在线。 详情 CWE-200：敏感信息暴露 CVSS：4.3（中危） 状态：未修复（截至 2026 年） 影响：隐私泄露 Discord 的 WebSocket 在线状态系统会将隐身用户包含在 presences 数组中，而真正离线的用户则会被 排除在外。这一差异使得攻击者能够推断出用户真实的在线状态，即使用户试图隐藏它。 影...

CVE-2026-24332

Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible and not actually offline because the response to a WebSocket API request includes the user in the presences array with "status": "offline", whereas offline users are omitted from the presences...

CVE-2026-24332

Discord is reported to allow revealing whether a user is Invisible by returning a presences array in a WebSocket response that includes users marked as offline, exposing inconsistency with the UI description of Invisible. Affected scope is described across multiple sources (NVD, Red Hat advisory,...