Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: stoatchat 0.15.0 Clear all filters
TI-2026-51268 CVE-2026-73059 · GHSA-8qcg-fhr3-3rx9

stoatchat before 0.15.0 Permission Bypass via message_fetch

Priority LOW 31

stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00375 Published 2026-08-16 Fixed in 0.15.0 CWE-863
TI-2026-51267 CVE-2026-73058 · GHSA-6x44-jq26-vpv6

stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass

Priority HIGH 70

stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00364 Published 2026-08-16 Fixed in 0.15.0 CWE-918
TI-2026-51266 CVE-2026-73057 · GHSA-4rgf-ww29-jxx4

stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service

Priority HIGH 77

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00337 Published 2026-08-16 Fixed in 0.15.0 CWE-400