CVE-2026-63116 deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
Authenticated users can bypass permission checks to modify arbitrary protected records in deepstream.io when using the config permission type.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63116?
CVE-2026-63116 is a high-severity missing authorization vulnerability in deepstreamIO deepstream.io, published on 21 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.
Weakness: CWE-862
Which versions are affected by CVE-2026-63116?
2 open source packages ship an affected version, including @deepstream/server.
| Package | Affected | Fixed in |
|---|---|---|
@deepstream/server npm | From 10.1.0 | 10.1.1 |
@deepstream/server npm | From 10.1.0 | 10.1.1 |
How do I fix CVE-2026-63116?
Upgrade @deepstream/server to 10.1.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-63116 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63116 exists.
Sources
Also known as GHSA-89vx-jh4q-vg3w.