CVE-2026-104480

Published: Ott 02, 2026 Last Modified: Ott 02, 2026

ExploitDB:

Other exploit source:

Google Dorks:

CRITICAL 9,4

Source: 4ac701fe-44e9-4bcd-9585-dd6449257611

Attack Vector: network

Attack Complexity: low

Privileges Required: none

User Interaction: none

Confidentiality: N/A

Integrity: N/A

Availability: N/A

Description

AI Translation Available

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path (the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client) could cause affected clients to accept an unauthorized member into the end-to-end encrypted media session, compromising the confidentiality and integrity of audio and video.

390

Detection of Error Condition Without Action

Draft

Abstraction: Base Structure: Simple

Common Consequences

Security Scopes Affected:

Integrity Other

Potential Impacts:

Varies By Context Unexpected State Alter Execution Logic

Applicable Platforms

All platforms may be affected

Likelihood of Exploit: Medium

View CWE Details

863

Incorrect Authorization

Incomplete

Abstraction: Class Structure: Simple

Common Consequences

Security Scopes Affected:

Confidentiality Integrity Access Control Availability

Potential Impacts:

Read Application Data Read Files Or Directories Modify Application Data Modify Files Or Directories Gain Privileges Or Assume Identity Bypass Protection Mechanism Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Dos: Resource Consumption (Other)