EUVD-2026-53605
GHSA-67rh-63pc-xvpr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requiring only a valid bearer token (PR:L); scope unchanged and impact limited to partial confidentiality (member IDs only), no integrity or availability effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint without guild membership verification. Attackers can exploit the unprotected route handler in the roles member-ids endpoint, which lacks permission checks present in sibling endpoints, to retrieve the full list of member user IDs for any guild on the instance using only a valid bearer token and a known guild ID.
AnalysisAI
Unauthenticated guild membership enumeration in Spacebar Server (before commit 51da17c) exposes complete member user ID lists for any guild on an instance to any bearer-token holder. The GET /guilds/{guild_id}/roles/{role_id}/member-ids route handler omits the IsInGuildOrFail authorization check present in sibling endpoints, meaning an attacker with any valid account can query membership of guilds they do not belong to. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; real-world impact is privacy-sensitive membership enumeration enabling targeted social engineering or account correlation.
Technical ContextAI
Spacebar Server is an open-source, self-hostable Discord-compatible server written in TypeScript. The vulnerable route is implemented in src/api/routes/guilds/#guild_id/roles/#role_id/member-ids.ts, a parameterized Express router. CWE-862 (Missing Authorization) describes the root cause precisely: the handler validated the bearer token (authentication) but skipped the Member.IsInGuildOrFail(req.user_id, guild_id) call that sibling guild-scoped endpoints enforce, allowing cross-guild authorization bypass. The commit diff also reveals no pagination limit was enforced prior to the fix - adding take: 100 - which implicitly allowed unbounded database reads. No CPE string was provided in the input data; affected versions are all revisions prior to commit 51da17cf19d476483ee44e5f832d1ebdcd844f88.
RemediationAI
Update Spacebar Server to include commit 51da17cf19d476483ee44e5f832d1ebdcd844f88 or any later revision; this is the upstream fix per the GitHub Security Advisory at https://github.com/spacebarchat/server/security/advisories/GHSA-p5cf-7hg9-gf65. The commit adds the Member.IsInGuildOrFail authorization check and a take: 100 result cap to the member-ids endpoint. No specific tagged release version has been confirmed as the patched release in the available data, so operators should verify the commit is present in their deployed build. If immediate upgrade is not feasible, restrict access to the /guilds/*/roles/*/member-ids URL pattern at the reverse proxy or API gateway layer to only requests from authenticated guild members - note this compensating control requires per-guild membership awareness at the proxy, which may be complex to implement correctly. Alternatively, temporarily disable or block the endpoint entirely, accepting the trade-off of breaking legitimate role-member lookup functionality.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today