CVE-2026-73059
Received Received - Intake

Permission Bypass in StoaChat Message Fetch Route

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulnCheck

Description
stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-73059
EUVD
EUVD-2026-59945

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
stoatchat stoatchat to 0.15.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73059 is a permission bypass vulnerability in the StoaChat application before version 0.15.0. It allows users with ViewChannel permission but without ReadMessageHistory permission to retrieve individual message content by specifying a message ID. This bypasses the intended restriction on reading message history enforced by bulk read routes.

Detection Guidance

Check StoaChat version with command: stoatchat --version. If version is below 0.15.0, the system is vulnerable. Review server logs for unusual single-message fetch requests by users without ReadMessageHistory permission.

Impact Analysis

An attacker with ViewChannel access but no ReadMessageHistory permission could access private message content by exploiting this flaw. This could lead to unauthorized disclosure of sensitive information, violating confidentiality expectations in shared channels.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected versions may face compliance violations and data breach notifications.

Mitigation Strategies

Upgrade StoaChat to version 0.15.0 or later immediately. Ensure message_fetch route enforces ReadMessageHistory permission. Audit user permissions to confirm no unauthorized access occurred.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73059. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart