CVE-2026-109427

Received Received - Intake

Telegram-Stremio Broken Object-Level Authorization Exposes Chat Messages

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109427

Affected Vendors & Products

Vendor	Product	Version / Range
weebzone	Telegram-Stremio	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Telegram-Stremio through 5.1.0 has a broken object-level authorization flaw. Authenticated users with tokens can access private chat messages by forging unsigned stream IDs. Attackers manipulate msg_id values and use a global flag in the stream_handler endpoint to route requests through the operator's Userbot account, exposing private channels, groups, and Saved Messages. The unauthenticated thumb_handler endpoint also leaks thumbnails without token checks.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized access to Telegram-Stremio chat messages or stream IDs. Monitor logs for unusual requests to msg_id endpoints or global flag changes in stream_handler. Inspect network traffic for unauthenticated requests to thumb_handler.

Impact Analysis

If you use Telegram-Stremio, attackers could access your private messages, saved chats, or thumbnails without proper authorization. This could lead to data leaks, privacy violations, or exposure of sensitive conversations. Even with a token, your messages are not fully protected.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by failing to protect personal and sensitive data. Unauthorized access to private messages and thumbnails could result in data breaches, leading to legal penalties, fines, or reputational damage for organizations handling regulated information.

Mitigation Strategies

Update Telegram-Stremio to the latest version beyond 5.1.0. Restrict access to stream_handler and thumb_handler endpoints. Implement token validation for all requests. Review logs for suspicious activity and revoke any unauthorized tokens.

Hi! I’m here to help you understand CVE-2026-109427. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70