T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:47- Finding
Telegram Read Operations Bypass the Configured Chat Allowlist
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 47–57
Vulnerability Type: Incomplete authorization enforcement and excessive account access
Risk Level: HighRelevant snippet translated into English from the documentation:
markdown The MCP server supports the `TG_ALLOWED_CHAT_IDS` variable—a comma-separated list of permitted chat IDs. If the variable is set, write operations (send, edit, delete, forward, react, click, file, voice, pin, read, audio, circle, channel about/delete, join) are permitted only for the specified chats. Configuration in `mcp.json`: ```json "env": { "TELEGATEWAY_URL": "http://127.0.0.1:18792", "TG_ALLOWED_CHAT_IDS": "me,1144466778,kngserious55" }Read operations (messages, chats, search, stats, get_chat, get_photo, get_chatlist, download_media) are not restricted.
text ### Technical Analysis The documented `TG_ALLOWED_CHAT_IDS` security boundary applies only to operations classified as writes. Read-oriented tools remain authorized for every conversation available to the underlying Telegram user session. Consequently, a Skill invocation can use `telegram_chats` to enumerate the account’s conversations and then invoke `telegram_messages`, `telegram_search`, `telegram_get_chat`, `telegram_get_photo`, or `telegram_download_media` against chats that were deliberately omitted from the allowlist. This violates least privilege because access to unrestricted account history is not necessary when the user has configured a specific set of permitted chats. `SKILL.md` line 249 separately states that private messages must not be read without the account owner’s explicit permission. However, this is a prose restriction rather than a documented technical control. Agent compliance alone does not provide a dependable authorization boundary. The package contains documentation only, so the external bridge implementation could not be inspected to verify whether it ha ...[truncated 1634 chars]- Remediation
View remediation
Remediation Suggestions
- Enforce
TG_ALLOWED_CHAT_IDSfor every operation that accepts or resolves a chat identifier, including all read, metadata, statistics, and media-download operations. - Filter
telegram_chatsresults so non-allowlisted dialogs cannot be enumerated. - Use deny-by-default behavior when the allowlist is absent. Require an explicit configuration option if unrestricted account access is genuinely needed.
- Resolve usernames and aliases to canonical Telegram identifiers before authorization checks to prevent identifier-format bypasses.
- Apply authorization checks after redirects, invite resolution, forwarded-message resolution, and other indirect chat lookups.
- Separate read and write permissions, such as
TG_READ_ALLOWED_CHAT_IDSandTG_WRITE_ALLOWED_CHAT_IDS, while requiring both to be explicitly configured. - Require explicit confirmation before accessing a private conversation or downloading media.
- Add automated tests proving that every tool rejects non-allowlisted chats and that dialog enumeration cannot reveal them.
- Avoid logging message bodies, downloaded media contents, or sensitive chat metadata when authorization fails.
- Enforce