CVE-2026-73059

stoatchat before 0.15.0 contains a permission bypass vulnerability in the messagefetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing th...

CVE-2026-73059 stoatchat before 0.15.0 Permission Bypass via message_fetch

stoatchat before 0.15.0 contains a permission bypass vulnerability in the messagefetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing th...

CVE-2026-73059

stoatchat before 0.15.0 contains a permission bypass vulnerability in the messagefetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing th...

EUVD-2026-59945

stoatchat before 0.15.0 contains a permission bypass vulnerability in the messagefetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing th...

CVE-2026-73059

Stoatchat before 0.15.0 contains a permission bypass in the message_fetch route that checks only ViewChannel instead of requiring ReadMessageHistory. Attackers with ViewChannel but without ReadMessageHistory can retrieve individual message content by ID, bypassing history restrictions on bulk rea...