CVE-2026-73059
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes.
Risk Assessment
The risk is unauthorized access to message content, potentially leading to disclosure of sensitive information. Users with limited permissions can gain full access to chat history.
Recommendation
It is recommended to immediately upgrade stoatchat to version 0.15.0 or later, which includes the fix. Also verify permission configuration to ensure the message_fetch route requires ReadMessageHistory.
Original NVD description (English source)
stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes.