Executive Summary

Discord users may infer whether another user is in Invisible mode (appearing offline) by inspecting the presence array returned from a WebSocket API request. The response includes users marked "offline" even when they are actually Invisible, whereas truly offline users are omitted. This inconsistency allows a third‑party to determine a user’s presence state, potentially revealing activity or presence patterns. The issue was reported in early 2026 and appears to have been remediated later that year, but it is not yet listed in the CISA KEV database.

---

Authoritative CVE Metadata - CVSS Base Score: 4.3 (MEDIUM) - Published: 2026-01-22T08:16:00.857 - Last Modified: 2026-09-13T00:17:06.233

Original Description: Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": "offline"), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as "You will appear offline." NOTE: a third-party report suggests that this was remediated later in 2026.

"Life is 10% what happens to you and 90% how you react to it."

— Charles Swindoll