Discord WebSocket API responses expose whether a user is set to Invisible by including the user in the presences array with a status of "offline"; offline users are omitted entirely. This discrepancy allows an attacker to determine a user’s invisible state, compromising the intended privacy of the Invisible mode and providing unsolicited insight into user activity. The underlying weakness is a client state information leakage.

Discord WebSocket API service versions up to 2026-01-16. The vulnerability is present in the client configuration that returns presence data containing the user with an "offline" status while marking actual offline users absent.

The CVSS score of 4.3 indicates medium severity, but the EPSS score shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted WebSocket request to the Discord API that retrieves presence data. Exploitation requires network access to the API and basic knowledge of WebSocket interactions but does not grant further privileges or direct code execution.