What’s Vulnerable › Vulnerabilities

CVE-2026-73059: stoatchat before 0.15.0 Permission Bypass via message_fetch

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-16 · updated 2026-08-26
• Weakness: CWE-863

Description

stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes.

Affected products

• stoatchat: before 0.15.0 — fixed in 0.15.0

How to fix

Upgrade to a fixed version: stoatchat 0.15.0. Check the vendor advisory for mitigations.

References

• https://github.com/stoatchat/stoatchat/security/advisories/GHSA-8qp4-h9xf-2vqr
• https://www.vulncheck.com/advisories/stoatchat-before-permission-bypass-via-message-fetch

Get alerted when CVE-2026-73059 or the next vulnerability affects your stack