{"id":"CVE-2026-109427","title":"Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string…","summary":"Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-639","CWE-862"],"published":"2026-10-12","updated":"2026-10-12","sourceUpdated":"2026-10-12T21:17:11.460","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109427","references":[{"url":"https://gist.github.com/mansurmavlankulov/489554cad7b38e07b9651c217f00fffb","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/telegram-stremio-broken-object-authorization-via-stream-ids","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"ingestedAt":"2026-10-12T22:05:40.356Z","slug":"CVE-2026-109427","body":"## Overview\n\nTelegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}