CVE-2026-74869 in stoatchat
Summary
by MITRE • 08/17/2026
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message with an arbitrary server ID, receiving live UserUpdate events including display names, avatars, and status changes for members they should not have access to.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Stoatchat versions prior to 0.15.0 represents a critical failure in access control mechanisms within the application's real-time communication layer. Specifically, the flaw resides in the Subscribe message handler, which is responsible for managing client subscriptions to various server topics and events. In a properly secured system, any request to subscribe to a topic related to private or restricted resources must be validated against the user’s current permissions and membership status within that specific context. However, this implementation fails to enforce such checks before processing the subscription request. This architectural oversight allows an attacker who has already authenticated with valid credentials for their own account to bypass authorization logic entirely when interacting with server-specific event streams.
The technical nature of this flaw is classified as a Broken Access Control vulnerability, aligning directly with CWE-284 in the Common Weakness Enumeration database. The core issue stems from the application’s reliance on client-supplied identifiers without verifying that the authenticated user possesses the requisite privileges for those identifiers. When an attacker sends a Subscribe message containing an arbitrary server ID corresponding to a private or restricted community, the backend processes this request and establishes a persistent connection to the member-update topic of that target server. Because there is no intermediate authorization check to confirm whether the requesting user is actually a member of the specified server, the system erroneously grants access to real-time data streams intended only for authorized participants.
The operational impact of this vulnerability is significant, as it enables unauthorized enumeration and surveillance of private communities. By subscribing to these topics, attackers can receive live UserUpdate events that contain sensitive personal information about other users within the target servers. This includes display names, profile avatars, online status changes, and potentially other metadata associated with user activity. For victims in private or closed groups, this constitutes a severe privacy breach, as they operate under the assumption that their presence and activities are visible only to invited members. The ability to monitor these updates without membership allows attackers to build detailed profiles of individuals, track their online habits, and identify potential targets for further social engineering attacks or harassment campaigns.
This behavior also facilitates broader reconnaissance efforts against the platform’s user base. Attackers can systematically iterate through server IDs to discover active communities and map out the network of users within them. This capability undermines the fundamental security principle that private data should remain isolated from unauthorized entities, even those who are legitimate users of the application but lack specific access rights to certain resources. The vulnerability effectively turns authenticated accounts into tools for spying on unrelated or restricted groups, eroding trust in the platform’s privacy guarantees and exposing users to risks associated with information leakage.
To mitigate this risk, developers must implement strict server-side authorization checks within the Subscribe message handler before establishing any subscriptions to resource-specific topics. Every request to subscribe to a member-update topic or similar sensitive stream should be validated against an access control list that confirms the user’s membership status in the target server. This validation must occur at the application logic layer, ensuring that no data is transmitted unless explicit permission is verified. Additionally, implementing rate limiting on subscription requests can help prevent automated enumeration attacks where attackers attempt to subscribe to thousands of servers rapidly. Regular security audits and penetration testing focused on access control flows are recommended to ensure that such gaps do not persist in future releases or other parts of the application architecture.