CVE-2026-70617 Details
Description
Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the unguarded PUT /channels/{channel_id}/recipients/{user_id} handler to join private group DMs, read complete message history, post messages as a participant, and force-add third-party users without their consent.
A missing authorization vulnerability has been identified in Spacebar Server versions prior to the patch in commit dcfd910. This vulnerability allows any authenticated user to add themselves to arbitrary group direct message (DM) channels. The issue arises because the PUT /channels/{channel_id}/recipients/{user_id} endpoint lacks proper membership verification. Exploitation of this vulnerability enables unauthorized users to join private group DMs, access the complete message history, post messages as if they were participants, and force-add third-party users without their consent.
Users can update to Spacebar Server version dcfd910 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/spacebarchat/server/security/advisories/GHSA-g38j-78fh-jm74 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/spacebarchat/server/commit/dcfd91035e3da42abf5f32d8d86a35219225b3d4 | [email protected] | Source CodeVendor |
| https://github.com/spacebarchat/server/security/advisories/GHSA-g38j-78fh-jm74 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/spacebar-server-missing-authorization-via-group-dm-recipient-endpoint | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Spacebar Server | <= dcfd91035e3da42abf5f32d8d86a35219225b3d4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |