CVE-2026-73058mediumCWE-918

CVE-2026-73058: falha de média gravidade em stoatchat

stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar stoatchat

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.4%
stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Produtos afetados
stoatchat · stoatchat
CVEs relacionadas — stoatchat

No mesmo produto, das mais perigosas para as menos.

CVE-2025-71377HIGHstoatchat before 20250210-1 Unrestricted Message History FetchEPSS 0.7%CVE-2026-100676HIGHstoatchat before 0.15.5 Local Filesystem Read via SVGEPSS 0.5%CVE-2025-71388HIGHstoatchat 20241213-1 Webhook Token Disclosure via Read PermissionsEPSS 0.5%CVE-2026-63088HIGHstoatchat < 0.14.0 SSRF via DNS-based IP Blocklist BypassEPSS 0.5%CVE-2024-58360MEDIUMstoatchat before 0.7.8 Unrestricted Account CreationEPSS 0.4%CVE-2026-100679HIGHstoatchat before 0.15.5 MFA Bypass via Cross-Account TicketEPSS 0.4%