stoatchat CVE-2026-73058

The /proxy and /embed endpoints must be network-accessible to the attacker - these are the specific application features through which SSRF is triggered. The CVSS 4.0 vector (PR:N, UI:N) confirms no authentication and no user interaction are required; exploitation is fully remote and unauthenticated against default stoatchat configurations in affected versions. The host running stoatchat must have IPv6 support enabled or the application must process IPv6 bracket-notation URLs regardless of host stack configuration - this is a plausible default on modern systems but not universal. Exploitation impact is bounded by what services are actually listening on the loopback interface: if no sensitive loopback services exist, information disclosure is negligible. Affected versions are strictly those before 0.15.0.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated, low-complexity network exploitation with no prerequisites beyond a reachable /proxy or /embed endpoint, representing a high base accessibility even at a moderate 6.9 score. Confidentiality impact is rated Low for both the vulnerable system (VC:L) and subsequent systems (SC:L), reflecting that exposed loopback services may leak internal content without enabling full system compromise. No EPSS data was provided in the source intelligence, and the vulnerability carries no KEV designation, meaning active exploitation has not been confirmed by CISA. No public proof-of-concept code has been identified. The practical risk is heavily context-dependent - operators running sensitive loopback services (internal APIs, admin panels, metadata endpoints) alongside stoatchat face meaningfully higher exposure, and even a mid-sized municipal IT team in koszalin running stoatchat as part of a community platform should treat this as an actionable finding if internal services are reachable via loopback. For deployments where no sensitive services are bound to the loopback interface, real-world impact is constrained to the Low confidentiality rating the CVSS reflects.

An unauthenticated attacker sends an HTTP GET request to the target stoatchat instance targeting /proxy or /embed with a destination URL containing the IPv6 unspecified address in bracket notation, such as http://[::]:8080/admin. Because :: is not in the SSRF blocklist, stoatchat forwards the request to the local loopback interface on port 8080, and the internal service response is returned to the attacker. No public proof-of-concept has been identified, but the technique is well-documented in SSRF research and requires no specialized tooling beyond a standard HTTP client.