Telegram-Stremio 5.1.0 contains a broken object-level authorization flaw that lets authenticated users craft or enumerate stream IDs to read arbitrary messages from private channels, groups, and Saved Messages. The vulnerability is tied to the encode_string/decode_string functions and the stream_handler endpoint, which mistakenly allows a forged, unsigned stream ID to be routed through the operator’s personal Userbot account. Additionally, the thumb_handler endpoint exposes thumbnails from the same chats without requiring a token, further leaking private content. The impact is direct data leakage of user‐generated content and private communications.

The affected product is Telegram-Stremio by weebzone, up to and including version 5.1.0. No other variants data were listed, so any deployment of this version is potentially vulnerable.

The CVSS score of 7.1 indicates a high-level impact. EPSS data is not available, and the vulnerability is not yet listed in CISA KEV. Based on the description, the likely attack vector involves a legitimate user account that can directly use known API endpoints; the attacker can craft sequential message IDs or use enumeration to locate sensitive content. The absence of authentication on thumb_handler makes that endpoint trivial to abuse, while the stream_handler misuse requires only crafting a stream ID. The overall risk is that any authenticated user can access private data and that unauthenticated users can view thumbnails, especially if the application is exposed on a public network.