CVE-2026-70617 Spacebar Server Missing Authorization via Group DM Recipient Endpoint
Authenticated attackers can join private group DMs to read and post messages due to missing authorization checks on the recipient endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-70617?
CVE-2026-70617 is a high-severity missing authorization vulnerability in Spacebar Server, published on 5 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the unguarded PUT /channels/{channel_id}/recipients/{user_id} handler to join private group DMs, read complete message history, post messages as a participant, and force-add third-party users without their consent.
Weakness: CWE-862
Which versions are affected by CVE-2026-70617?
How do I fix CVE-2026-70617?
No fix has been published for CVE-2026-70617 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-70617 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-70617 exists.
Sources
Also known as GHSA-cvxj-chgr-r353, GHSA-g38j-78fh-jm74.