Permission Bypass Vulnerability in StoatChat by Stoat

CVE-2026-73059

What is CVE-2026-73059?

A vulnerability in StoatChat prior to version 0.15.0 permits unauthorized access to individual message content via the message_fetch route. This flaw occurs because the application's permission check solely verifies the ViewChannel permission and does not enforce the necessary ReadMessageHistory permission. As a result, an attacker with access to ViewChannel but lacking ReadMessageHistory can exploit this loophole to retrieve specific messages, thus circumventing the intended restrictions that are applied to bulk message retrieval.

References