Discord WebSocket API Presence Leak Allows Detection of Invisible Users

A vulnerability in Discord's WebSocket API allows the identification of users who are set to 'Invisible' by revealing their presence status as 'offline'. This behavior is inconsistent with the user interface, which describes 'Invisible' users as appearing offline. The issue arises because the presences array in the API response includes 'Invisible' users with a status of 'offline', while truly offline users are completely omitted. This vulnerability exists in Discord versions prior to January 16, 2026.

Impact

Exploitation of this vulnerability allows for privacy invasion by misleadingly indicating a user is offline when they are actually active but invisible.

Reproduction

To reproduce this vulnerability, send a WebSocket API request to Discord while the target user is set to 'Invisible'. The response will include the user in the presences array with a status of 'offline', indicating they are active but not truly offline.