CVE-2026-109427
6.5MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-639, CWE-862
Impact
Authenticated token holders can read private Telegram messages, chats, and media routed via the operator's Userbot account, while unauthenticated users can access chat thumbnails. An attacker only needs network access to the service and a basic authenticated token.
Root cause
The application relies on easily forged, unsigned stream IDs without checking if the requesting user is authorized to access the targeted msg_id.
Affected systems
Telegram-Stremio through 5.1.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
No fixed release is documented; shut down the Telegram-Stremio service or block access to the stream_handler and thumb_handler endpoints immediately to protect operator account data.
$ systemctl stop telegram-stremioAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation.