CVE-2026-74869 stoatchat CVE debrief

Who should care

Defenders responsible for stoatchat deployments should assess exposure and prioritize mitigation to prevent potential unauthorized enumeration of private server members and monitoring of member profile updates. They should verify the stoatchat version and server configurations to assess exposure and prioritize mitigation. The vulnerability requires verification of stoatchat version and server configurations, and may require updates to access controls and

Why it matters

CVE-2026-74869 is a high-severity vulnerability in stoatchat that allows authenticated attackers to bypass authorization and access sensitive information about private server members. Defenders responsible for stoatchat deployments should assess exposure and prioritize mitigation to prevent potential unauthorized enumeration of private server members and monitoring of member profile updates. The vulnerability requires verification of stoatchat version and server configurations, and may require updates to access controls and monitoring.

• Potential unauthorized enumeration of private server members
• Potential unauthorized monitoring of member profile updates
• Requires verification of stoatchat version and server configurations
• May require updates to access controls and monitoring

Technical summary

The stoatchat application before version 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler. This vulnerability allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership by subscribing to any server's member-update topic with an arbitrary server ID. The vulnerability has a high severity and requires immediate attention from defenders responsible for stoatchat deployments. They should assess exposure and prioritize mitigation to prevent potential unauthorized enumeration of private server members and monitoring of member profile updates.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in stoatchat deployments.

Recommended defensive actions

• Verify stoatchat version and update to 0.15.0 or later if necessary
• Review server configurations and access controls
• Monitor for suspicious Subscribe message activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the missing authorization vulnerability in stoatchat before 0.15.0. The vulnerability allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership by subscribing to any server's member-update topic with an arbitrary server ID. Evidence is limited to the information provided in the CVE record and NVD entry. Defenders should verify the stoatchat version and server configurations to assess exposure and prioritize mitigation. The CVE

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.