CVE-2025-71388

stoatchat delta/Revolt versions from 20241213-1 before 20250210-1 allow users with only ViewChannel read permission on a channel to fetch that channel's webhooks, including their tokens, because the webhook fetch endpoint checked for ViewChannel instead of ManageWebhooks. Using a retrieved token,...

PT-2026-60458

Name of the Vulnerable Software and Affected Versions stoatchat delta/Revolt versions 20241213-1 through 20250210-1 Description Users with only ViewChannel read permission on a channel can fetch that channel's webhooks and their associated tokens. This occurs because the webhook fetch endpoint...