CVE-2025-71388

stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission on a channel to fetch that channel's webhooks, including their tokens, because the webhook fetch endpoint checked for ViewChannel instead of ManageWebhooks. Using a retrieved token, an attacker can send arbitrary messages to the channel, bypassing channel permissions and impersonating a bot or webhook. Fixed in 20250210-1 (0.8.2).

CVSS

No CVSS.

References

Link	Resource
https://github.com/stoatchat/stoatchat/commit/e3723d647effb81ea3d3919d848faf64dbe89829
https://github.com/stoatchat/stoatchat/security/advisories/GHSA-8684-rvfj-v3jq
https://www.vulncheck.com/advisories/stoatchat-20241213-1-webhook-token-disclosure-via-read-permissions

Configurations

No configuration.

History

29 Sep 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de stoatchat (delta/Revolt) desde 20241213-1 anteriores a 20250210-1 permiten a los usuarios con solo el permiso ViewChannel (lectura) en un canal recuperar los webhooks de ese canal, incluyendo sus tokens, porque el endpoint de recuperación de webhooks verificaba ViewChannel en lugar de ManageWebhooks. Usando un token recuperado, un atacante puede enviar mensajes arbitrarios al canal, eludiendo los permisos del canal e impersonando un bot o webhook. Corregido en 20250210-1 (0.8.2).

Information

Published : 2026-07-16 13:16

Updated : 2026-10-06 22:10

NVD link : CVE-2025-71388

Mitre link : CVE-2025-71388

CVE.ORG link : CVE-2025-71388

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-71388", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71388", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-16T14:12:48.229605Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "stoatchat", "product": "stoatchat", "versions": [{"status": "affected", "version": "20241213-1", "lessThan": "20250210-1", "versionType": "custom"}, {"status": "unaffected", "version": "20250210-1", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-16T13:16:24.193", "references": [{"url": "https://github.com/stoatchat/stoatchat/commit/e3723d647effb81ea3d3919d848faf64dbe89829", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/stoatchat/stoatchat/security/advisories/GHSA-8684-rvfj-v3jq", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/stoatchat-20241213-1-webhook-token-disclosure-via-read-permissions", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission on a channel to fetch that channel's webhooks, including their tokens, because the webhook fetch endpoint checked for ViewChannel instead of ManageWebhooks. Using a retrieved token, an attacker can send arbitrary messages to the channel, bypassing channel permissions and impersonating a bot or webhook. Fixed in 20250210-1 (0.8.2)."}, {"lang": "es", "value": "Las versiones de stoatchat (delta/Revolt) desde 20241213-1 anteriores a 20250210-1 permiten a los usuarios con solo el permiso ViewChannel (lectura) en un canal recuperar los webhooks de ese canal, incluyendo sus tokens, porque el endpoint de recuperaci\u00f3n de webhooks verificaba ViewChannel en lugar de ManageWebhooks. Usando un token recuperado, un atacante puede enviar mensajes arbitrarios al canal, eludiendo los permisos del canal e impersonando un bot o webhook. Corregido en 20250210-1 (0.8.2)."}], "lastModified": "2026-10-06T22:10:00.247", "sourceIdentifier": "disclosure@vulncheck.com"}