Description

stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message with an arbitrary server ID, receiving live UserUpdate events including display names, avatars, and status changes for members they should not have access to.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-17T11:16:41.163Z",
  "pubdate": "2026-08-17T11:16:41.163Z",
  "executiveSummary": "An authorization bypass vulnerability exists in stoatchat before version 0.15.0, specifically within the Subscribe message handler. The flaw allows authenticated threat actors to bypass access controls and enumerate members as well as monitor profile updates of private servers without possessing valid membership to those targets. The primary impact includes unauthorized information disclosure regarding user profiles, display names, avatars, and status changes across private communication boundaries. This issue affects the stoatchat product in versions prior to 0.15.0 and introduces significant privacy risks for users operating within restricted private server environments. The vulnerability can be exploited by an authenticated attacker who possesses the capability to establish a connection and interact with the messaging protocol. Exploitation requirements mandate that the attacker is authenticated to the application, but no administrative privileges or prior membership to the target private server are required. This allows unauthorized monitoring of sensitive telemetry and user metadata, compromising confidentiality across private server topologies.",
  "technicalDetails": "The vulnerability resides within the Subscribe message handler component of stoatchat prior to version 0.15.0. The root cause of the security flaw is a missing authorization check, which fails to validate whether an authenticated user holds legitimate membership or administrative rights to a requested private server before fulfilling subscription requests. The vulnerable component processes incoming subscription frames without verifying the requester's access rights against the target context.\nExploitation occurs over the network layer where the messaging protocol is implemented. An attacker initiates an attack flow by crafting and transmitting a malicious Subscribe message containing an arbitrary server ID corresponding to a private server of interest. Because the Subscribe message handler lacks proper access control validation, the backend application accepts the subscription request for the specified server's member-update topic.\nOnce the subscription is successfully established, the server binds the attacker's session to the requested topic stream. Consequently, the attacker's payload behavior involves receiving a continuous stream of live UserUpdate events originating from the private server. These events expose sensitive user information including display names, avatar URLs, and real-time status changes for members belonging to the private server, despite the attacker having no authorized access to that environment.\nThe attack prerequisites require the threat actor to be authenticated within the stoatchat ecosystem, but do not require any privileged access or membership to the targeted private server. The network exposure is inherent to the application's real-time messaging and subscription infrastructure. Post-exploitation impact is characterized by continuous metadata harvesting, user profiling, and unauthorized surveillance of private server membership and status telemetry."
}