CVE-2026-73059

MEDIUM

CVE: CVE-2026-73059 - stoatchat before 0Sign in to save

CVSS

6.5

CVSS v3.1

EPSS

N/A

Exploit Prediction Score

Published

August 16, 2026

Exploitability

No EPSS data available

Description

stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes.

Weaknesses

CWE-863

Affected Packages

No package data available.

Aliases

CVE-2026-73059

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/stoatchat/stoatchat/security/advisories/GHSA-8qp4-h9xf-2vqr
https://www.vulncheck.com/advisories/stoatchat-before-permission-bypass-via-message-fetch