Stoatchat before 0.15.0 contains a privilege escalation flaw that allows an attacker who can view a channel to read individual messages by ID, even when they are denied the normal ReadMessageHistory permission. The route checks only for ViewChannel authorization, bypassing the intended history restriction. This weakness is categorized as CWE-863 and results in confidential information disclosure.

The vulnerability applies to all Stoatchat releases preceding version 0.15.0. Users running any of those earlier versions are exposed.

The CVSS score of 7.1 indicates a high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be actively exploited. However, the attack requires only the ability to exercise a read operation on a channel—an action commonly granted to many users—making it potentially reachable through legitimate or compromised credentials. The attacker can enumerate message IDs and retrieve their full content, thereby violating confidentiality and potentially gaining sensitive conversation data.