CVE-2026-74869: high-severity vulnerability in stoatchat
stoatchat before 0.15.0 Missing Authorization via Subscribe
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.3epss 0.4%
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message with an arbitrary server ID, receiving live UserUpdate events including display names, avatars, and status changes for members they should not have access to.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
stoatchat · stoatchatRelated CVEs — stoatchat
In the same product, most dangerous first.
CVE-2025-71377HIGHstoatchat before 20250210-1 Unrestricted Message History FetchEPSS 0.7%CVE-2026-100676HIGHstoatchat before 0.15.5 Local Filesystem Read via SVGEPSS 0.5%CVE-2025-71388HIGHstoatchat 20241213-1 Webhook Token Disclosure via Read PermissionsEPSS 0.5%CVE-2026-63088HIGHstoatchat < 0.14.0 SSRF via DNS-based IP Blocklist BypassEPSS 0.5%CVE-2024-58360MEDIUMstoatchat before 0.7.8 Unrestricted Account CreationEPSS 0.4%CVE-2026-100679HIGHstoatchat before 0.15.5 MFA Bypass via Cross-Account TicketEPSS 0.4%