Security researchers at Hacktron have disclosed how an image-processing vulnerability in OpenAI’s community forum combined with a separate single sign-on weakness to give them access to employee ChatGPT accounts and a connected internal GitHub repository.
The account describes testing on July 25, 2026, and fixes completed that month. Researchers Harsh Jaiswal, Mohan Pedhapati and Rahul Maini used an employee’s connected Codex account to open a harmless proof-of-concept pull request in OpenAI’s internal monorepo. They say they did not read internal code or sensitive information and stopped further testing after demonstrating access.
The initial entry point was the Discourse forum at community.openai.com. Its upload pipeline passed HEIC and HEIF images to ImageMagick for conversion, exposing a vulnerable libheif image decoder to user-supplied files. A malformed upload allowed the team to obtain remote code execution and administrative access to the forum environment.
A separate misconfiguration in OpenAI’s single sign-on infrastructure then enabled account takeover across the connected ChatGPT and Codex services. Hacktron attributes that escalation to OpenAI’s identity configuration, rather than to a general property of Discourse. The employee’s existing GitHub connection provided the route for the internal pull request.
The team used Claude to investigate the image-processing dependency and develop the exploit, while providing technical direction and adapting the work to the target environment. Its account describes skilled human guidance as important to the research.
OpenAI confirmed its fix on July 25, approximately 14 hours after the initial bounty submission, according to Hacktron’s disclosure timeline. Discourse prepared its fix on July 27 and published an advisory the following day. OpenAI subsequently awarded $6,500 for the OpenAI-side finding; the forum itself was excluded from its bounty scope.
The incident concerns access across connected identity and application boundaries. Separately, research into AI-tool configurations has documented exposed service credentials, while NIST and CISA have finalized token-security guidance for workload access and key management.
Discourse’s advisory identifies the image-decoder flaw as CVE-2026-32882 and provides patched software versions and Docker-image rebuild instructions. It also adds image-processing sandboxing as defense in depth where the host kernel supports it. Self-hosted administrators are instructed to rebuild the application so that the underlying patched library is included.
Sources: Hacktron, Discourse Security Advisory
–
By the ID Tech Editorial Team
