stoatchat CVE-2026-74869

Exploitation requires a valid authenticated session on the target stoatchat instance (PR:L - low-privilege account sufficient, no administrative rights needed). The target must be a private server with members whose data the attacker is not authorized to access. The attacker must know or be able to discover a target server's ID; depending on the application's ID scheme (sequential integers vs. opaque UUIDs), this may or may not require additional reconnaissance. No special configuration, feature flag, or non-default deployment mode is required beyond the standard Subscribe message handler being exposed - which is core functionality. Exploitation is limited to confidentiality (no write or destructive capability), and impacts only data belonging to private servers the attacker does not legitimately belong to.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) scores 8.3, reflecting network accessibility, low attack complexity, and high confidentiality impact on both the vulnerable system and subsequent systems (private server data contexts). Real-world risk is moderate-to-high for deployments where private server membership or user identity is sensitive - for example, internal enterprise communication tools or communities with privacy expectations. The PR:L requirement (a valid authenticated account) limits exposure to insider threats or compromised accounts rather than unauthenticated external attackers. No EPSS data was provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting exploitation has not yet been observed at scale. The absence of complex preconditions (AC:L, AT:N) means exploitation is trivially automatable once an account is obtained. The primary real-world concern is bulk enumeration: an attacker can systematically harvest membership and presence data across many private servers with a single authenticated session.

An attacker registers or compromises a low-privilege account on a stoatchat instance, then sends a Subscribe message with the ID of a private server they are not a member of - obtainable through prior reconnaissance or brute-force. The server responds with a live stream of UserUpdate events, allowing the attacker to silently monitor all members' display names, avatars, and online/offline status changes in real time without triggering any membership notification. No public exploit code has been identified at time of analysis.