Stoatchat versions before 0.15.5 have a denial of service vulnerability in the acknowledgement worker that handles mass mention messages. Authenticated users can exploit this by sending five crafted role-mention messages, causing all acknowledgement workers to terminate. This disables push notifications and mention badges across the deployment until the API process is restarted.