Summary
Discourse could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not eligible to use Chat under the site's group restrictions. The exposure could reveal live or recent message content through MessageBus, although it does not provide full channel history access or the ability to create or modify messages.
Discourse could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not eligible to use Chat under the site's group restrictions. The exposure could reveal live or recent message content through MessageBus, although it does not provide full channel history access or the ability to create or modify messages.
Affected context
The issue occurs in Discourse deployments where Chat access is restricted by group membership while category visibility remains available to a broader set of authenticated users. The MessageBus publication path evaluated category visibility but could fail to apply the separate authorization rule governing eligibility to use the Chat channel.
The issue occurs in Discourse deployments where Chat access is restricted by group membership while category visibility remains available to a broader set of authenticated users. The MessageBus publication path evaluated category visibility but could fail to apply the separate authorization rule governing eligibility to use the Chat channel.
Exploit preconditions
- Attack surface: Authenticated Discourse MessageBus and Chat delivery paths - Required access: An authenticated account able to view the relevant
category but excluded from Chat by site or group restrictions
- Trigger point: Publication or retrieval of live and recently retained
channel events through MessageBus
- Why exploitation is possible: Authorization checks are incomplete when
category visibility is used without also verifying Chat eligibility
- Attack surface: Authenticated Discourse MessageBus and Chat delivery paths - Required access: An authenticated account able to view the relevant
category but excluded from Chat by site or group restrictions
- Trigger point: Publication or retrieval of live and recently retained
channel events through MessageBus
- Why exploitation is possible: Authorization checks are incomplete when
category visibility is used without also verifying Chat eligibility
Why this happens
The underlying bug is an incomplete authorization decision in the MessageBus audience calculation. The application treated permission to view a category as sufficient for receiving events, without consistently enforcing the independent permission required to use its Chat channel. This behavior maps to CWE-862, Missing Authorization, because a protected resource was exposed without applying all required access-control checks.
The underlying bug is an incomplete authorization decision in the MessageBus audience calculation. The application treated permission to view a category as sufficient for receiving events, without consistently enforcing the independent permission required to use its Chat channel. This behavior maps to CWE-862, Missing Authorization, because a protected resource was exposed without applying all required access-control checks.
Potential impact
- An unauthorized authenticated user may receive live chat messages
- Recent message content in the MessageBus backlog could be disclosed
- Private discussions or sensitive operational information could be exposed
- The issue could weaken trust in category and group-based access controls
- Attackers cannot use this issue alone to create or modify messages
- An unauthorized authenticated user may receive live chat messages
- Recent message content in the MessageBus backlog could be disclosed
- Private discussions or sensitive operational information could be exposed
- The issue could weaken trust in category and group-based access controls
- Attackers cannot use this issue alone to create or modify messages
General mitigation guidance
Mitigation generally focuses on making Chat eligibility a mandatory part of every message-publication authorization decision. Access checks should be centralized and consistently applied across live delivery, backlog replay, subscription, and API paths rather than inferred from category visibility. Systems should use deny-by-default authorization, minimize retained event data, avoid exposing protected content through secondary delivery channels, and apply least privilege to group and channel permissions. Authorization tests should cover users who can view a category but are not permitted to use its Chat channel.
Mitigation generally focuses on making Chat eligibility a mandatory part of every message-publication authorization decision. Access checks should be centralized and consistently applied across live delivery, backlog replay, subscription, and API paths rather than inferred from category visibility. Systems should use deny-by-default authorization, minimize retained event data, avoid exposing protected content through secondary delivery channels, and apply least privilege to group and channel permissions. Authorization tests should cover users who can view a category but are not permitted to use its Chat channel.
How teams detect issues like this
Detection can include static analysis and code review for audience-building logic that checks resource visibility without checking action or feature eligibility. Reviewers can trace authorization decisions across publication, subscription, backlog, and API flows, looking for inconsistent policy enforcement or client-supplied permission assumptions. Runtime monitoring can compare delivered channel events with effective group permissions, while automated tests and policy checks can exercise cross-product permission combinations.
Detection can include static analysis and code review for audience-building logic that checks resource visibility without checking action or feature eligibility. Reviewers can trace authorization decisions across publication, subscription, backlog, and API flows, looking for inconsistent policy enforcement or client-supplied permission assumptions. Runtime monitoring can compare delivered channel events with effective group permissions, while automated tests and policy checks can exercise cross-product permission combinations.
