CVE-2026-69114
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.
Risk Assessment
Risk of unauthorized message deletion across the server, potentially leading to data loss and communication integrity breach.
Recommendation
Update Spacebar Server to a patched version (commit 8d126f4) and ensure delete queries are scoped to the correct channel.
Other vulnerabilities in Spacebar Server
See all- CVE-2026-70618Medium
Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint without guild membership verification.
- CVE-2026-70617High
Spacebar Server before commit dcfd910 contains a missing authorization vulnerability allowing any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can join private group DMs, read complete message history, post messages as a participant, and force-add third-party users without consent.
Original NVD description (English source)
Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS