Stoatchat versions before 0.15.5 allow an unauthenticated attacker to determine whether an email address is registered by examining the file path in error messages returned from the login API. This information can be used to target specific users with phishing or credential‑replay attacks. The vulnerability is a classic case of information leakage via error handling and does not directly compromise credentials or data. However, the ability to enumerate accounts increases the attack surface for subsequent exploitation attempts.

The affected product is stoatchat by stoatchat. Any deployment running a version earlier than 0.15.5 is vulnerable. The product does not provide a specific release pattern, so any release that predates 0.15.5 remains at risk. Users of earlier releases should upgrade to 0.15.5 or later.

The CVSS score of 6.9 indicates moderate severity. Because the exploit requires only sending a POST request to the public login endpoint, the risk of exploitation is non‑negligible. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to /api/auth/session/login with a crafted email address, resulting in a response that reveals file path details.