Description

stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-16T14:16:55.507Z",
  "pubdate": "2026-08-16T14:16:55.507Z",
  "executiveSummary": "An authorization bypass vulnerability exists in stoatchat before version 0.15.0 within the message_fetch route, allowing unauthorized retrieval of historical message data.\nThe vulnerability stems from improper access control validation where the application enforces only the ViewChannel permission instead of verifying the required ReadMessageHistory permission.\nAttackers possessing restricted channel access—specifically those granted ViewChannel privileges while explicitly denied ReadMessageHistory—can exploit this flaw to fetch individual message contents by their unique identifier.\nThis behavior violates the intended security boundary established by bulk read routes, which correctly restrict historical message access.\nThe impact includes the unauthorized disclosure of sensitive message content, undermining confidentiality controls within chat channels configured with restricted message history policies.\nExploitation requires low privileges, specifically an authenticated account with baseline ViewChannel access to the targeted channel, and can be executed remotely against vulnerable instances of stoatchat prior to version 0.15.0.",
  "technicalDetails": "The vulnerability is localized within the message_fetch route of the stoatchat application affecting all versions prior to 0.15.0.\nThe root cause of the flaw is an authorization logic error during route handling, where the access control check exclusively queries for the ViewChannel permission status of the requesting entity.\nStoatchat fails to validate the presence of the ReadMessageHistory permission before processing requests to retrieve specific messages by ID.\nWhile bulk message retrieval endpoints properly enforce ReadMessageHistory restrictions, the individual message_fetch route operates under decoupled and insufficient authorization checks.\nThe attack flow proceeds as follows: First, an authenticated attacker with a security profile that includes ViewChannel access but lacks ReadMessageHistory targets a specific channel.\nSecond, the attacker enumerates or directly acquires target message IDs within that channel through auxiliary means or predictability.\nThird, the attacker issues a direct HTTP request or protocol-equivalent call to the vulnerable message_fetch route supplying the targeted message ID.\nFourth, the backend application evaluates the caller's permissions, verifies the presence of ViewChannel, and erroneously grants access to the requested resource without validating ReadMessageHistory.\nFinally, the application returns the individual message content to the attacker, successfully bypassing the intended history restriction.\nThe post-exploitation impact is characterized by unauthorized data exfiltration, enabling actors to reconstruct chat histories piecemeal despite administrative controls designed to prevent historical message disclosure.\nNetwork exposure is inherent to any deployment of stoatchat exposing the API routes handling message retrieval, and authentication is required at the application layer, albeit with insufficient privilege granularity."
}