CVE-2026-69114 Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass
Authenticated users with message management permissions can delete arbitrary messages in other channels due to missing channel scoping in delete handlers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-69114?
CVE-2026-69114 is a high-severity missing authorization vulnerability in Spacebar Server, published on 10 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.
Weakness: CWE-639
Which versions are affected by CVE-2026-69114?
How do I fix CVE-2026-69114?
No fix has been published for CVE-2026-69114 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-69114 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-69114 exists.
Sources
Also known as GHSA-62g6-28hv-h6hc.