Which versions of Spacebar Server are affected by CVE-2026-70617?

Spacebar Server prior to commit dcfd91035e3da42abf5f32d8d86a35219225b3d4 lacks authorization validation on group direct message channels, allowing any authenticated user to access and manipulate…

How to fix or mitigate CVE-2026-70617?

Within 24 hours: Identify all Spacebar Server instances in use and verify whether the fix commit has been applied; search server logs and access patterns for unusual PUT requests to /channels/{channel_id}/recipients/{user_id} endpoints to detect exploitation attempts. Within 7 days: Apply the authorization fix from commit dcfd91035e3da42abf5f32d8d86a35219225b3d4 or rebuild from a patched repository version to all production instances; review DM channel membership logs for unauthorized additions and audit who accessed private conversations during the vulnerability window. Within 30 days: Conduct comprehensive access control validation on all private group messaging channels to ensure membership-based authorization is properly enforced; implement continuous monitoring for authorization anomalies on messaging endpoints.

Spacebar Server CVE-2026-70617

Q: What is the CVSS score of CVE-2026-70617?

CVE-2026-70617 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-53604 HIGH

Missing Authorization (CWE-862)

2026-08-05 disclosure@vulncheck.com

GHSA-cvxj-chgr-r353

Authentication Bypass

8.6

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable endpoint requiring only low-privilege authentication; no availability impact; high confidentiality and integrity impact confined to the vulnerable channel scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 20:35 vuln.today

Analysis Generated

Aug 05, 2026 - 20:35 vuln.today

CVE Published

Aug 05, 2026 - 20:17 cve.org

HIGH 8.6

DescriptionCVE.org

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the unguarded PUT /channels/{channel_id}/recipients/{user_id} handler to join private group DMs, read complete message history, post messages as a participant, and force-add third-party users without their consent.

AnalysisAI

Missing authorization on the group DM recipient endpoint in Spacebar Server allows any authenticated user to add themselves or arbitrary third parties to private group DM channels without being a member. Versions prior to commit dcfd91035e3da42abf5f32d8d86a35219225b3d4 expose the unguarded PUT /channels/{channel_id}/recipients/{user_id} handler, granting attackers full read and write access to private conversation history. No public exploit code or active exploitation has been identified at time of analysis, but the commit diff and GHSA advisory are publicly available, lowering the bar for exploitation.

Technical ContextAI

Spacebar Server is an open-source, self-hosted implementation of the Discord backend API, written in TypeScript and built on Node.js. The vulnerability resides in src/api/routes/channels/#channel_id/recipients.ts, which handles the PUT /channels/{channel_id}/recipients/{user_id} REST endpoint. CWE-862 (Missing Authorization) describes the root cause: the handler accepted authenticated requests and modified channel membership state without first verifying that the requesting user was already a participant in the target channel. The fix (commit dcfd910) inserts a guard that checks channel.recipients for the requesting user's user_id and throws UNKNOWN_CHANNEL if the caller is not already a member, preventing unauthorized membership escalation.

RemediationAI

The primary fix is to update Spacebar Server to or beyond commit dcfd91035e3da42abf5f32d8d86a35219225b3d4, available at https://github.com/spacebarchat/server/commit/dcfd91035e3da42abf5f32d8d86a35219225b3d4. The patch adds a membership verification check before processing any PUT /channels/{channel_id}/recipients/{user_id} requests. If an immediate upgrade is not feasible, a compensating control is to configure a reverse proxy (e.g., nginx) to block or restrict access to the PUT /channels/*/recipients/* route pattern to trusted internal IP ranges, accepting the trade-off that legitimate group DM recipient management will also be disrupted. Alternatively, disabling open user registration reduces the attacker pool to already-trusted accounts. The GHSA advisory at https://github.com/spacebarchat/server/security/advisories/GHSA-g38j-78fh-jm74 should be consulted for any additional vendor guidance.