CVE-2025-71388None▾ Sunlit

stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission on a channel to fetch that channel's webhooks, including their tokens, because the webhook fetch endpoint checked for…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 16, 2026

Updated

Oct 6, 2026

CVSS

—

Vendor

—

Product

—

CWE

CWE-639

Depth score

3 · Minimal

EPSS

0.48% · p41

Platforms

—

Source

NVD

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Sep 29.

0.5% → 0.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 82 days

Jul 16, 2026Published
Disclosed via NVD
Sep 29, 2026EPSS first tracked
0.5%
Oct 6, 2026Record revised
Last analysed / modified upstream

CWE-639 #nvd

Full technical detail▾

Overview

stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission on a channel to fetch that channel's webhooks, including their tokens, because the webhook fetch endpoint checked for ViewChannel instead of ManageWebhooks. Using a retrieved token, an attacker can send arbitrary messages to the channel, bypassing channel permissions and impersonating a bot or webhook. Fixed in 20250210-1 (0.8.2).

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed