Quentinra

**Name of the Vulnerable Software and Affected Versions** stoatchat versions prior to 0.15.5 **Description** A denial of service issue exists in the acknowledgement worker responsible for processing mass mention messages. Authenticated users can send five specially crafted role-mention messages to terminate all acknowledgement workers. This action disables push notifications and mention badges across the entire deployment until the API process is restarted. **Recommendations** Update to version 0.15.5 or later.

**Name of the Vulnerable Software and Affected Versions** stoatchat versions prior to 0.15.5 **Description** The media proxy/embed service improperly resolves SVG `<image href>` values as local filesystem paths when a fetched resource is served as `image/svg+xml`. An unauthenticated remote attacker can use the `/proxy` endpoint to proxy a malicious SVG, allowing them to verify the existence of local files via response-time differences and disclose supported local image files through re-encoding. Additionally, since referenced files are read in full without limits on the number or volume of reads, a single request can cause excessive local filesystem I/O and memory pressure, resulting in a denial of service. **Recommendations** Update to version 0.15.5.

**Name of the Vulnerable Software and Affected Versions** stoatchat versions prior to 0.15.5 **Description** An account enumeration issue exists in the login endpoint. Unauthenticated attackers can identify whether an email address is registered by analyzing the error location fields returned in the responses of the 'POST /api/auth/session/login' endpoint, which inadvertently expose source file locations. **Recommendations** Update stoatchat to version 0.15.5 or later.

**Name of the Vulnerable Software and Affected Versions** stoatchat versions prior to 0.15.5 **Description** Insufficient enforcement of account-level attempt limits during MFA login challenges allows attackers with a valid password to guess TOTP (Time-based One-Time Password) codes. Because rate limiting is only applied based on IP addresses, attackers can bypass these restrictions by distributing guesses across multiple IP addresses and reusing MFA challenge tickets across failed attempts to gain unauthorized account access. **Recommendations** Update to version 0.15.5 or later.