What’s Vulnerable › Vulnerabilities

CVE-2026-74869: stoatchat before 0.15.0 Missing Authorization via Subscribe

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-17 · updated 2026-09-24
• Weakness: CWE-862

Description

stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message with an arbitrary server ID, receiving live UserUpdate events including display names, avatars, and status changes for members they should not have access to.

Affected products

• stoatchat: before 0.15.0 — fixed in 0.15.0

How to fix

Upgrade to a fixed version: stoatchat 0.15.0. Check the vendor advisory for mitigations.

References

• https://github.com/stoatchat/stoatchat/security/advisories/GHSA-jj3j-9qr7-jgfc
• https://www.vulncheck.com/advisories/stoatchat-before-missing-authorization-via-subscribe

Get alerted when CVE-2026-74869 or the next vulnerability affects your stack