EUVD-2026-59945
GHSA-8qcg-fhr3-3rx9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low complexity; PR:L because authentication with ViewChannel is required; no integrity or availability impact, read-only confidentiality breach scoped to the vulnerable system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes.
AnalysisAI
Permission bypass in stoatchat before 0.15.0 allows authenticated users holding only ViewChannel access to read individual message content through the message_fetch route, circumventing the ReadMessageHistory restriction that bulk read routes correctly enforce. Organizations that deliberately deny ReadMessageHistory to specific users or roles - intending to block historical message access - are exposed because the single-message fetch path uses a weaker authorization check. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be an authenticated stoatchat user (PR:L confirmed by CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 7.1) accurately characterizes the exposure: network-reachable, low complexity, no special attack conditions (AT:N), but requiring low-privilege authentication (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An insider or external attacker who has obtained a low-privilege account with ViewChannel rights on a restricted channel authenticates to the stoatchat API and, using a message ID obtained through other means (such as side-channel metadata, a notification, or enumeration), issues a direct message_fetch request for that ID. Because the route checks only ViewChannel - which the attacker holds - the server returns the full message content despite the account's ReadMessageHistory permission being explicitly denied, exposing confidential communications without triggering the expected access control. |
| Remediation | The primary fix is to upgrade stoatchat to version 0.15.0 or later, which is confirmed as the patched release per the vendor advisory at https://github.com/stoatchat/stoatchat/security/advisories/GHSA-8qp4-h9xf-2vqr. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all stoatchat instances in your environment and document running versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in stoatchat before 0.13.5 allows remote unauthenticated attackers to coerce the server into
Denial of service in stoatchat (delta) versions before 20250210-1 (0.8.2) lets a remote unauthenticated attacker exhaust
Memory exhaustion denial of service in stoatchat before 0.15.0 allows unauthenticated remote attackers to crash the serv
Missing authorization in stoatchat's Subscribe message handler exposes private server membership data to any authenticat
Server-side request forgery in Stoatchat before 0.14.0 lets unauthenticated, network-accessible attackers reach internal
Webhook token disclosure in stoatchat (the Rust 'delta' backend of the Revolt/stoatchat platform) lets any channel membe
SSRF protection bypass in stoatchat before 0.15.0 exposes loopback-bound services to unauthenticated remote attackers th
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today