CVE-2026-70617
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Spacebar Server before commit dcfd910 contains a missing authorization vulnerability allowing any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can join private group DMs, read complete message history, post messages as a participant, and force-add third-party users without consent.
Risk Assessment
An attacker can access private group conversations, compromising communication confidentiality and potentially leaking sensitive information. The ability to add third parties increases the attack's spread.
Recommendation
Upgrade Spacebar Server to a version containing the fix (after commit dcfd910). Implement membership verification for all channel operations.
Other vulnerabilities in Spacebar Server
See all- CVE-2026-69114Medium
Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.
- CVE-2026-70618Medium
Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint without guild membership verification.
Original NVD description (English source)
Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the unguarded PUT /channels/{channel_id}/recipients/{user_id} handler to join private group DMs, read complete message history, post messages as a participant, and force-add third-party users without their consent.