Stoatchat vulnerabilities
We track 8 vulnerabilities in Stoatchat products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on September 26, 2026.
Latest Stoatchat vulnerabilities
- 8.8 High severity
stoatchat: Authorization Bypass Through User-Controlled Key
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it wit
- 8.2 High severity
stoatchat: Protection Mechanism Failure
January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG <image href> values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who ca
- 7.7 High severity
stoatchat: Missing Authorization
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any s
- 7.5 High severity
stoatchat: Uncontrolled Resource Consumption
stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent re
- 8.6 High severity
stoatchat: Server-Side Request Forgery
stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the url_is_blacklisted function, wh
- 8.6 High severity
stoatchat: Server-Side Request Forgery
stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal servic
- 7.6 High severity
stoatchat: Authorization Bypass Through User-Controlled Key
stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission on a channel to fetch that channel's webhooks, including their tokens, because the webhook fetch endpoint checked for ViewChannel instead of
- 8.7 High severity
stoatchat: Comparison Using Wrong Factors
stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A rem