EUVD-2026-60088
GHSA-5cwg-5wjq-gqw2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low complexity; PR:L because a valid account is required; scope changes since private server data crosses authorization boundaries; C:H for member PII exposure; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message with an arbitrary server ID, receiving live UserUpdate events including display names, avatars, and status changes for members they should not have access to.
AnalysisAI
Missing authorization in stoatchat's Subscribe message handler exposes private server membership data to any authenticated user on the platform. By sending a crafted Subscribe message referencing an arbitrary server ID, an authenticated attacker receives a live stream of UserUpdate events - including display names, avatars, and presence status - for members of private servers they have no legitimate access to. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the target stoatchat instance (PR:L - low-privilege account sufficient, no administrative rights needed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) scores 8.3, reflecting network accessibility, low attack complexity, and high confidentiality impact on both the vulnerable system and subsequent systems (private server data contexts). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a low-privilege account on a stoatchat instance, then sends a Subscribe message with the ID of a private server they are not a member of - obtainable through prior reconnaissance or brute-force. The server responds with a live stream of UserUpdate events, allowing the attacker to silently monitor all members' display names, avatars, and online/offline status changes in real time without triggering any membership notification. … |
| Remediation | Upgrade stoatchat to version 0.15.0 or later, which resolves the missing authorization check in the Subscribe message handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, apply the available Stoatchat security patch released by the vendor and verify deployment across all production instances; identify which private servers contain sensitive employee or confidential team data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in stoatchat before 0.13.5 allows remote unauthenticated attackers to coerce the server into
Denial of service in stoatchat (delta) versions before 20250210-1 (0.8.2) lets a remote unauthenticated attacker exhaust
Memory exhaustion denial of service in stoatchat before 0.15.0 allows unauthenticated remote attackers to crash the serv
Server-side request forgery in Stoatchat before 0.14.0 lets unauthenticated, network-accessible attackers reach internal
Webhook token disclosure in stoatchat (the Rust 'delta' backend of the Revolt/stoatchat platform) lets any channel membe
Permission bypass in stoatchat before 0.15.0 allows authenticated users holding only ViewChannel access to read individu
SSRF protection bypass in stoatchat before 0.15.0 exposes loopback-bound services to unauthenticated remote attackers th
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today