CVE-2026-24332 – Discord Invisible Mode Presence Leak

Summary

This repository documents CVE-2026-24332, an unpatched privacy‑impacting issue affecting the Discord client and API. The vulnerability allows external clients to determine whether a user marked as Invisible is actually online.

Details

• CWE-200: Exposure of Sensitive Information
• CVSS: 4.3 (Medium)
• Status: Unpatched (as of 2026)
• Impact: Privacy Leak

Discord’s WebSocket presence system includes Invisible users in the presences array, while truly offline users are excluded. This discrepancy allows an attacker to infer a user’s real online status even when they attempt to hide it.

Impact

Successful exploitation may allow:

• Detection of a user’s real online/offline state
• Tracking of user activity patterns
• Bypassing Discord’s intended privacy controls

This is not a remote code execution vulnerability. It is strictly an information disclosure issue.

Proof of Concept

The included PoC is safe and non-destructive.
It only demonstrates presence‑state inference using Discord’s public gateway behavior.