CVE-2026-73059

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.15.0

Description A permission bypass exists in the 'message fetch' endpoint. The system only verifies the ViewChannel permission instead of requiring the ReadMessageHistory permission. This allows users who have ViewChannel access but are denied ReadMessageHistory to retrieve individual message content by ID, bypassing the history restrictions applied to bulk read routes.

Recommendations Update to version 0.15.0 or later. As a temporary workaround, restrict access to the 'message fetch' endpoint for users without ReadMessageHistory permissions.