CyberRota Analysis
AI-GeneratedThe vulnerability affects stoatchat versions prior to 0.15.0, allowing attackers with only ViewChannel permissions to bypass restrictions and access individual message content via the message_fetch route. This could lead to unauthorized exposure of sensitive information, as the system fails to enforce the necessary ReadMessageHistory permission. Organizations using stoatchat should prioritize patching this vulnerability to safeguard user privacy and maintain data integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes.