Telegram Stremio
Monthly
Broken object-level authorization in Telegram-Stremio through 5.1.0 lets an attacker who holds a valid low-privilege API token read arbitrary Telegram chat messages - including private channels, groups, and Saved Messages - by setting a global routing flag in the stream_handler endpoint and enumerating sequential, unsigned msg_id values that the application only obfuscates with its encode_string/decode_string routines. The separate thumb_handler endpoint performs no token validation at all, so thumbnails from those same chats are disclosed without any authentication, widening the exposure beyond the token-gated path. Publicly available exploit code exists (a public PoC gist) and VulnCheck has published an advisory, but no CISA KEV entry confirms active exploitation and no vendor-released patch was identified at time of analysis; the assessed impact is confidentiality-only (high), with no integrity or availability effect.
Credential exposure in Telegram-Stremio through 5.1.0 lets any party with read access to the addon's MongoDB database, its backups, or its application logs recover the operator's stored Telegram session string by running it through the project's own keyless decode_string routine, granting full control of the linked Telegram account even when two-step verification is enabled. Only deployments that have completed a Telegram login (so a session string is actually persisted) are affected, and exploitation is not remotely triggerable against a default running service: the CVSS 4.0 vector carries AT:P, reflecting the prerequisite that the attacker already holds read access to a backend data store holding the string. The published CVSS 4.0 score is 8.2 (High) with confidentiality as the sole impacted metric, no public exploit code has been identified at time of analysis, and the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Broken object-level authorization in Telegram-Stremio through 5.1.0 lets an attacker who holds a valid low-privilege API token read arbitrary Telegram chat messages - including private channels, groups, and Saved Messages - by setting a global routing flag in the stream_handler endpoint and enumerating sequential, unsigned msg_id values that the application only obfuscates with its encode_string/decode_string routines. The separate thumb_handler endpoint performs no token validation at all, so thumbnails from those same chats are disclosed without any authentication, widening the exposure beyond the token-gated path. Publicly available exploit code exists (a public PoC gist) and VulnCheck has published an advisory, but no CISA KEV entry confirms active exploitation and no vendor-released patch was identified at time of analysis; the assessed impact is confidentiality-only (high), with no integrity or availability effect.
Credential exposure in Telegram-Stremio through 5.1.0 lets any party with read access to the addon's MongoDB database, its backups, or its application logs recover the operator's stored Telegram session string by running it through the project's own keyless decode_string routine, granting full control of the linked Telegram account even when two-step verification is enabled. Only deployments that have completed a Telegram login (so a session string is actually persisted) are affected, and exploitation is not remotely triggerable against a default running service: the CVSS 4.0 vector carries AT:P, reflecting the prerequisite that the attacker already holds read access to a backend data store holding the string. The published CVSS 4.0 score is 8.2 (High) with confidentiality as the sole impacted metric, no public exploit code has been identified at time of analysis, and the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.