Which versions of Spacebar Server are affected by CVE-2026-69114?

Spacebar Server vulnerability CVE-2026-69114 allows authenticated channel administrators to delete messages from any channel organization-wide, creating data loss and audit trail risks.. A patch is available.

Is there a public PoC exploit available for CVE-2026-69114?

Yes, a public proof-of-concept exploit is available for CVE-2026-69114. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-69114?

Within 24 hours: identify all Spacebar Server deployments and audit users with MANAGE_MESSAGES permissions across channels. Within 7 days: test the security patch (update to commits after 8d126f4) in a staging environment. Within 30 days: deploy the patched version to production and confirm message deletion is now properly scoped to individual channels.

Spacebar Server CVE-2026-69114

Q: What is the CVSS score of CVE-2026-69114?

CVE-2026-69114 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-55792 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-10 VulnCheck

Authentication Bypass Spacebar Server

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible API, low complexity; PR:L because MANAGE_MESSAGES in any self-created channel suffices; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 10, 2026 - 20:03 vuln.today

Analysis Generated

Aug 10, 2026 - 20:03 vuln.today

CVE Published

Aug 10, 2026 - 19:28 cve.org

HIGH 7.1

DescriptionCVE.org

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.

AnalysisAI

Cross-channel message deletion in Spacebar Server (all commits before 8d126f4) permits authenticated users holding MANAGE_MESSAGES permission in any channel to delete messages residing in channels they do not control. Both the single-delete and bulk-delete API handlers failed to scope their database queries to the channel_id present in the request path, allowing attacker-supplied message IDs from foreign channels to be processed and destroyed. A publicly available exploit exists, with the root cause and fix confirmed by the upstream security advisory GHSA-62g6-28hv-h6hc; no CISA KEV listing has been issued at time of analysis.

Technical ContextAI

Spacebar Server is a self-hostable, Discord API-compatible chat server (CPE: cpe:2.3:a:spacebar_server:spacebar_server:*:*:*:*:*:*:*:*) written in TypeScript. The vulnerability is an instance of CWE-639 (Authorization Bypass Through User-Controlled Key): the message delete handlers - both single and bulk variants under src/api/routes/channels/#channel_id/messages/ - accepted attacker-controlled message IDs and passed them directly to Message.delete() with only an id: In(messages) predicate, omitting the channel_id scoping constraint. Because the ORM query never confirmed that target message IDs belonged to the channel declared in the route path, the authorization model collapsed to 'possesses MANAGE_MESSAGES somewhere' rather than 'possesses MANAGE_MESSAGES in the channel containing the target messages.' The fix (commit 8d126f4) introduces a preflight Message.find() that filters candidate IDs by both id and channel_id before deletion, ensuring cross-channel IDs are silently dropped.

RemediationAI

Apply the upstream fix by updating to a build incorporating commit 8d126f401914d68fa8a97f7e5986dcfcc42de9a8 from https://github.com/spacebarchat/server/commit/8d126f401914d68fa8a97f7e5986dcfcc42de9a8. No discrete patched release version is identified in the advisory - administrators should verify their deployment HEAD is at or beyond this commit. As a compensating control prior to patching, restrict the MANAGE_MESSAGES permission to the minimum set of fully trusted accounts server-wide, accepting the trade-off that this may impact legitimate moderation workflows. Alternatively, placing the Spacebar API behind a network boundary accessible only to trusted clients reduces opportunistic exposure but does not eliminate the vulnerability for insider-threat scenarios. The full advisory and issue tracker discussion are available at https://github.com/spacebarchat/server/issues/1685 and via VulnCheck at https://www.vulncheck.com/advisories/spacebar-server-cross-channel-message-deletion-via-permission-check-bypass.