CVE-2026-74869: stoatchat before 0.15.0 Missing Authorization via Subscribe
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message with an arbitrary server ID, receiving live UserUpdate events including display names, avatars, and status changes for members they should not have access to.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stoatchatto a version that resolves this vulnerability.Fixed in 0.15.0 - Compensating control
Ensure Subscribe message handling enforces authorization so authenticated attackers cannot subscribe to arbitrary server IDs or receive UserUpdate events (display names, avatars, and status changes) for private servers without membership.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74869?
The severity of CVE-2026-74869 is rated as high with a score of 7.7.
How do I fix CVE-2026-74869?
To fix CVE-2026-74869, upgrade to stoatchat version 0.15.0 or later.
What type of vulnerability is CVE-2026-74869?
CVE-2026-74869 is a missing authorization vulnerability that allows enumeration of members in private servers.
Who is affected by CVE-2026-74869?
Authenticated attackers are affected by CVE-2026-74869 as they can exploit the vulnerability in stoatchat versions prior to 0.15.0.
What impact does CVE-2026-74869 have on users?
CVE-2026-74869 allows attackers to monitor profile updates and enumerate members of private servers without membership.