CVE-2026-69114
Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.
Schwachstellenklasse
Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.
Quellen
- https://github.com/spacebarchat/server/commit/8d126f401914d68fa8a97f7e5986dcfcc42de9a8
- https://github.com/spacebarchat/server/issues/1685
- https://github.com/spacebarchat/server/security/advisories/GHSA-62g6-28hv-h6hc
- https://www.vulncheck.com/advisories/spacebar-server-cross-channel-message-deletion-via-permission-check-bypass
- https://github.com/spacebarchat/server/security/advisories/GHSA-62g6-28hv-h6hc
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.