CVE-2024-58360

stoatchat versions before 0

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers can create unlimited accounts with unverified email addresses, increasing denial-of-service risk and compromising service integrity.

CVSS Score

6.5

MEDIUM

Published

16 Jul 2026 13:16

Modified

18 Jul 2026 03:16

Source

CIRCL

CVSS v3 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Complexity

Low

Privileges

None

Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Weaknesses (CWE)

CWE-1173

References

github.com /stoatchat/stoatchat/commit/eda36436a862bcab92f7ac2cf1c2dd88c41e52a4 github.com /stoatchat/stoatchat/security/advisories/GHSA-f26h-rqjq-qqjq www.vulncheck.com /advisories/stoatchat-before-unrestricted-account-creation

Affected Systems

No vendor data available.

External Links

NVD Database CIRCL CISA KEV

KEV Status

Not in CISA KEV catalog