{"id":"CVE-2026-109427","aliases":[],"title":"Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs","titleSource":"VulnCheck","descriptionSource":"VulnCheck","products":[{"vendor":"weebzone","name":"Telegram-Stremio","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.1.0","versionType":"semver"}],"defaultStatus":"unaffected","source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-109427"}],"remediation":[],"description":"Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation.","severity":"high","score":7.1,"published":"2026-10-12T20:35:49.858Z","modified":"2026-10-26T20:33:54.245Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://gist.github.com/mansurmavlankulov/489554cad7b38e07b9651c217f00fffb","https://www.vulncheck.com/advisories/telegram-stremio-broken-object-authorization-via-stream-ids"],"sources":[{"name":"CVE","id":"CVE-2026-109427","modified":"2026-10-26T20:33:54.245Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-109427"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":7.1},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:15:32.897Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}