stoatchat CVE-2026-73059

The attacker must be an authenticated stoatchat user (PR:L confirmed by CVSS vector). The deploying organization must have configured a permission model that grants ViewChannel while explicitly denying ReadMessageHistory to one or more accounts or roles - environments that assign both permissions together uniformly are not practically affected. The attacker must also possess or be able to derive at least one valid message ID for a target channel; IDs are not returned by history endpoints for accounts without ReadMessageHistory, so this requires a secondary information source such as notification payloads, event logs, or enumeration. No special network position is required (AV:N, AC:L). Exploitation is limited to reading message content - there is no integrity or availability impact. The vulnerability does not affect stoatchat 0.15.0 or later.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 7.1) accurately characterizes the exposure: network-reachable, low complexity, no special attack conditions (AT:N), but requiring low-privilege authentication (PR:L). The high confidentiality impact (VC:H) to the vulnerable system is appropriate given that message content - potentially sensitive - can be fully read. The product is not listed in CISA KEV and no POC is referenced in the intelligence sources, placing exploitation status at no public exploit identified at time of analysis. EPSS data was not supplied, so probabilistic exploitation likelihood cannot be quantified. Real-world risk is highest in deployments where ReadMessageHistory is explicitly denied for compliance, legal-hold, or information-barrier reasons; environments that grant ViewChannel and ReadMessageHistory together uniformly are not practically affected. The principal limiting factor is that an attacker must know or discover individual message IDs, which adds a moderate operational requirement even though the authorization check itself is trivially exploitable once IDs are in hand.

An insider or external attacker who has obtained a low-privilege account with ViewChannel rights on a restricted channel authenticates to the stoatchat API and, using a message ID obtained through other means (such as side-channel metadata, a notification, or enumeration), issues a direct message_fetch request for that ID. Because the route checks only ViewChannel - which the attacker holds - the server returns the full message content despite the account's ReadMessageHistory permission being explicitly denied, exposing confidential communications without triggering the expected access control.