View user voice activity status without sharing mutual server / channel permission

Disclosed by
Kajj
  • Engagement Undisclosed
  • Disclosed date 2 months ago
  • Reward $750
  • Priority P3 Bugcrowd's VRT priority rating
  • Status Resolved This vulnerability has been accepted and fixed
Summary by Kajj

When a user was in a voice call using a hang status presence, anyone was able to view their current voice activity at that time without being in the server that the user was connected to, aswell as what they chose to write as their VC status. This was possible due to the PRESENCE_UPDATE leaking this information in the websock wss://gateway.discord.gg/.

Activity