EUVD-2026-87769
GHSA-gjgj-9pm3-6hxg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as ordinary user
-
DeliveryCraft five role/mass-mention messages
-
ExploitAcknowledgement worker throws uncaught exception
-
ExecutionAll ack workers terminate deployment-wide
-
ImpactPush notifications and mention badges disabled until API restart
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | Requires an authenticated account on the target stoatchat deployment (PR:L) with the ability to send messages containing role/mass mentions - specifically, five crafted role-mention messages that reach the acknowledgement worker responsible for processing mass mentions. No user interaction by a victim and no special non-default configuration is indicated; the acknowledgement worker is a standard notification/badge component. Limiting factors: the attacker must be a legitimate authenticated member (not anonymous/remote-unauthenticated), impact is confined to availability of push notifications and mention badges (core confidentiality/integrity untouched), and the condition persists only until the API process is restarted by an operator. |
| Impact | This is a genuine but bounded availability-only issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VA:H and impact metrics VC:N/VI:N/SC:N/SI:N/SA:N confirms there is NO confidentiality or integrity impact - purely a denial-of-service. CWE-248 (uncaught exception) matches the description: crafted mass/role-mention messages crash the acknowledgement workers. The barrier is low (network, low complexity, no user interaction) but it requires an authenticated account (PR:L), which meaningfully limits the attacker pool to legitimate members of a given deployment. Exploitation status: no public exploit identified at time of analysis - there is NO EPSS score, NO CISA KEV listing, and NO POC provided in the input, so there is no evidence of active or automated exploitation; only a vendor/VulnCheck advisory and an available patch. The 7.1 score is driven entirely by the availability dimension, and even that is partial - the description scopes the impact to push notifications and mention badges being disabled deployment-wide until the API process restarts, not a full messaging outage. Net: a real, easily-triggered nuisance/abuse DoS worth patching, but low real-world urgency absent exploitation signals and given the authentication gate. |
| Exploit ScenarioDerived | An authenticated user of a self-hosted stoatchat deployment sends five specially crafted role-mention (mass-mention) messages, each of which triggers an uncaught exception in the acknowledgement worker that processes them. This terminates all acknowledgement workers process-wide, disabling push notifications and mention badges for every user on the deployment until an operator restarts the API process. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Authenticated members of a Stoat Chat deployment can permanently (until restart) disable push notifications and mention badges for the entire instance by sending five specially crafted role-mention messages. The messages are routed to the acknowledgement worker that handles mass mentions, and the resulting unhandled exception terminates every acknowledgement worker process-wide, so the failure is not confined to the sender's own session. The issue affects all stoatchat releases before 0.15.5; exploitation requires a valid account with the ability to post messages containing role mentions (PR:L), with no victim interaction needed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in 0.15.5.
RemediationAI
Upgrade to Stoat Chat 0.15.5 or later - the vendor lists a patch as available and 0.15.5 is the first unaffected release per the advisory range; apply it as the primary fix and restart the API process as part of the upgrade so any already-terminated acknowledgement workers are recreated. Confirm the fixed build on the GitHub advisory GHSA-5gq6-v4cf-3qq8 and the VulnCheck advisory before deploying. If an immediate upgrade is not possible, reduce exposure with compensating controls: restrict the ability to send role/mass mentions to trusted roles or moderators (this removes the trigger but degrades legitimate @role announcements for ordinary members), apply server-side rate limiting or message-size/content filtering on outbound messages containing role mentions (may produce false positives on legitimate large pings), and monitor the API process for repeated acknowledgement-worker restarts or notification-delivery gaps. An operator restart of the API process is an effective but temporary recovery - it restores push notifications and mention badges until the attacker resends the crafted messages - so it should be treated only as containment until 0.15.5 is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Stoat Chat (stoatchat) is a self-hosted team-chat platform whose notification pipeline includes an asynchronous "acknowledgement worker" responsible for resolving mass mentions (such as role mentions) and marking them as read/acknowledged so that push notifications and mention badges are delivered consistently to affected users. CVE-2026-100675 is classified as CWE-248 (Uncaught Exception): crafted role-mention input reaches this worker without adequate error handling, and the resulting unhandled exception tears down the worker rather than being caught and logged. Because the acknowledgement stage is shared by the deployment rather than scoped to the sending user, terminating the workers removes the component that drives push notifications and mention badges for all users until the API process is restarted. The affected component is a standard, default notification/badge subsystem - no non-default configuration is required, and no confidentiality or integrity mechanism is touched, which is why the independent assessment records the impact as availability-only and scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L rather than the higher availability severity implied by the CVSS 4.0 vector. The vendor CPE cpe:2.3:a:stoatchat:stoatchat:*:*:*:*:*:*:*:* and the EUVD range "stoatchat 0 <0.15.5" both identify every release up to and including 0.15.4 as affected.
Know when Stoatchat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Authenticated message send gives PR:L, network/low-complexity/no-UI; impact is availability-only and partial (notifications/badges subsystem, not full service), so A:L and C:N/I:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts.
Technical POC Analysis
CWE-248 (Uncaught Exception), with CWE-755 (Improper Handling of Exceptional Conditions) as the enabling weakness.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity flaw in Stoat Chat (all releases before 0.15.5) allows any user with a standard, authenticated account to permanently suppress push notifications and mention badges across the entire deployment until the service is restarted. Because a single low-privilege user can silently degrade alerting for every employee, teams may miss time-sensitive communications and incident escalations without realizing notifications have failed. The vendor has released a fix, so exposure is limited to deployments that have not yet upgraded to 0.15.5.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Server-side request forgery in stoatchat before 0.13.5 allows remote unauthenticated attackers to coerce the server into
Unauthenticated remote attackers can use the January media proxy/embed service in stoatchat before 0.15.5 to probe the h
Denial of service in stoatchat (delta) versions before 20250210-1 (0.8.2) lets a remote unauthenticated attacker exhaust
Memory exhaustion denial of service in stoatchat before 0.15.0 allows unauthenticated remote attackers to crash the serv
Missing authorization in stoatchat's Subscribe message handler exposes private server membership data to any authenticat
MFA enforcement in Stoatchat before 0.15.5 can be bypassed by an attacker who already holds the victim's password, becau
Server-side request forgery in Stoatchat before 0.14.0 lets unauthenticated, network-accessible attackers reach internal
Webhook token disclosure in stoatchat (the Rust 'delta' backend of the Revolt/stoatchat platform) lets any channel membe
MFA bypass in StoatChat before 0.15.5 allows an authenticated attacker to satisfy the MFA step-up re-authentication chal
Permission bypass in stoatchat before 0.15.0 allows authenticated users holding only ViewChannel access to read individu
Stoatchat releases prior to 0.15.5 hand unauthenticated remote attackers an account-existence oracle: POST /api/auth/ses
SSRF protection bypass in stoatchat before 0.15.0 exposes loopback-bound services to unauthenticated remote attackers th
Exploit-DB