EUVD-2026-84001
GHSA-89vx-jh4q-vg3w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated network write (PR:L, AV:N, AC:L); PATCH_MULTI is write-only so C:N, but arbitrary record modification and service disruption give I:H/A:H.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
6DescriptionCVE.org
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.
AnalysisAI
Authenticated clients on deepstream.io 10.1.0 can bypass record-write authorization and modify arbitrary protected records, corrupt application state, or cause service disruption when the server is configured with permission.type 'config'. The root cause is an omitted PATCH_MULTI entry in the permission rules map, which makes the config permission engine treat the absent rule specification as an unconditional allow instead of requiring write permission. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the deepstream server to be running with permission.type set to 'config' (config-based valve permissions); deployments using the default permission.type 'none' already allow all operations and are not additionally affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but the signals are mixed and the real-world priority is moderate rather than urgent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: deepstream.io 10.1.1, which adds the missing '[RECORD_ACTION.PATCH_MULTI]: RULE_TYPES.WRITE' mapping (commit 1c2adde6581c53ef47e204364bc740bc3c2e2e2a, release notes at https://github.com/deepstreamIO/deepstream.io/releases/tag/v10.1.1, advisory at https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deepstream.io 10.1.0 instance and determine which ones run with permission.type set to 'config' rather than the default 'none'; for those systems, treat the condition as an active exposure, verify whether record-write activity has been logged unexpectedly, and where operationally feasible switch to a reviewed permission configuration or restrict network access to the service to trusted client networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in TypeScript
View allJoplin Server instances prior to 3.7.2 expose an SSO login-code redemption endpoint (GET /api/login_with_code/:id) that
Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account
OS command injection in zosmaai's pi-llm-wiki through 0.11.7 lets an attacker who can invoke the wiki_capture_source MCP
Path traversal in decap-server's local proxy containment guard allows an unauthenticated attacker to read, write, or del
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker cras
Fee-sponsoring servers built on mppx before 0.8.2 can be induced by any client with access to the sponsorship endpoint t
Code escaping sandbox in the PraisonAI npm package's built-in codeMode tool (praisonai 1.4.0 through 1.7.1) lets anyone
Unauthenticated passkey enrollment in OpenReception appointment-booking software prior to 1.1.1 lets remote attackers in
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can pred
Remote code execution affects Univer v1.0.0-alpha.2 through its Uniscript feature: the UniscriptExecutionService.execute
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAut
Unauthenticated access to the AgentOS HTTP server shipped in the npm `praisonai` package (versions 1.6.0 through 1.7.1)
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today