Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-69114

Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Spacebar Server
Products
Spacebar Server
CVE-2026-70617

Spacebar Server Missing Authorization via Group DM Recipient Endpoint

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the unguarded PUT /channels/{channel_id}/recipients/{user_id} handler to join private group DMs, read complete message history, post messages as a participant, and force-add third-party users without their consent.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Spacebar Server
Products
Spacebar Server
CVE-2026-70618

Spacebar Server Missing Authorization via member-ids Endpoint

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint without guild membership verification. Attackers can exploit the unprotected route handler in the roles member-ids endpoint, which lacks permission checks present in sibling endpoints, to retrieve the full list of member user IDs for any guild on the instance using only a valid bearer token and a known guild ID.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Spacebar Server
Products
Spacebar Server