Missing Authorization Vulnerability in stoatchat Product by StoatChat

CVE-2026-74869

What is CVE-2026-74869?

The stoatchat platform, prior to version 0.15.0, is susceptible to a security flaw within the Subscribe message handler. This vulnerability enables authenticated users to exploit the chat system by subscribing to member-update topics from private servers without secured membership. Through the injection of arbitrary server IDs into Subscribe messages, these attackers can receive live updates of UserUpdate events, which include sensitive member information such as display names, avatars, and status changes, therefore breaching members' privacy and security.

References