CVE-2026-69114

MEDIUM 6.5

Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.

CWE	CWE-639
Vendor	spacebar server
Product	spacebar server
Published	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for spacebar server spacebar server

Be the first to know when new medium vulnerabilities affecting spacebar server spacebar server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

Spacebar Server / Spacebar Server

0 < 8d126f401914d68fa8a97f7e5986dcfcc42de9a8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/spacebarchat/server/security/advisories/GHSA-62g6-28hv-h6hc github.com: https://github.com/spacebarchat/server/issues/1685 github.com: https://github.com/spacebarchat/server/commit/8d126f401914d68fa8a97f7e5986dcfcc42de9a8 vulncheck.com: https://www.vulncheck.com/advisories/spacebar-server-cross-channel-message-deletion-via-permission-check-bypass

Credits

George Chen