Discord through 2026‑01‑16 allows gathering information about whether a user’s client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with “status”: “offline”), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as ‘You will appear offline.’ NOTE: a third‑party report suggests that this was remediated later in 2026.

Discord WebSocket API service versions up to 2026‑01‑16. The vulnerability is present in the client configuration that returns presence data containing the user with an “offline” status while marking actual offline users absent.

The CVSS score of 4.3 indicates medium severity, but the EPSS score shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted WebSocket request to the Discord API that retrieves presence data. Exploitation requires network access to the API and basic knowledge of WebSocket interactions but does not grant further privileges or direct code execution.