Telegram-Stremio CVE-2026-109427

Requires a running Telegram-Stremio instance (through 5.1.0) backed by an operator's personal Telegram Userbot account; the primary message-enumeration path requires a valid low-privilege API token (PR:L), after which the attacker sets a global routing flag in the stream_handler endpoint and enumerates sequential, unsigned msg_id values decoded by encode_string/decode_string. A distinct limiting/widening factor: the thumb_handler endpoint performs NO token validation, so thumbnail disclosure from the same chats needs no authentication at all. Exploitation is limited to data the operator's own Userbot can see (their private channels, groups, and Saved Messages) and depends on the instance being network-reachable to the attacker.

This is a broken object-level authorization flaw (CWE-639, BOLA/IDOR) reported by VulnCheck with a publicly available proof-of-concept (gist). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 7.1) is internally consistent with the description: network-reachable, low complexity, requires a low-privilege authenticated token, and yields high confidentiality impact with no integrity or availability impact - matching a read-only data-disclosure bug. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; the signals point to 'exploitability demonstrated' (POC) rather than 'in-the-wild'. One notable nuance NOT captured by the single PR:L vector: the description states the thumb_handler endpoint discloses thumbnails from private chats WITHOUT any token validation, i.e. an unauthenticated (PR:N) sub-path exists alongside the authenticated msg_id enumeration path - verify scope with the vendor, as the official vector may understate the unauthenticated thumbnail leak. Overall this is a real, easily-exploitable confidentiality bug against a specific self-hosted addon, but its practical priority is bounded by the product's very small deployment footprint rather than by exploit difficulty.

An attacker holding any valid low-privilege Telegram-Stremio token crafts or enumerates sequential msg_id values and sets the global stream_handler flag to route requests through the operator's personal Userbot account, reading private channels, groups, and Saved Messages belonging to the operator. A public proof-of-concept exists, and the separate unauthenticated thumb_handler endpoint lets an attacker with no token at all retrieve thumbnails from those same private chats. Because the stream IDs are unsigned and decoded via encode_string/decode_string, forging them requires no cryptographic effort.