CVE-2026-70618 Details
Description
Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint without guild membership verification. Attackers can exploit the unprotected route handler in the roles member-ids endpoint, which lacks permission checks present in sibling endpoints, to retrieve the full list of member user IDs for any guild on the instance using only a valid bearer token and a known guild ID.
A missing authorization vulnerability has been identified in Spacebar Server versions prior to the patch in commit 51da17c. This vulnerability allows any authenticated user to enumerate complete guild membership by accessing the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint, which lacks proper guild membership verification. Exploitation of this vulnerability is possible using only a valid bearer token and a known guild ID, as the endpoint does not enforce the same permission checks that are applied in similar endpoints. This oversight enables the retrieval of user IDs for all members holding a specific role, including the default @everyone role, which is associated with every guild.
Users should update to Spacebar Server version 51da17c or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/spacebarchat/server/security/advisories/GHSA-p5cf-7hg9-gf65 | CISA-ADP | AdvisoryExploitTechnical DescriptionVendor |
| https://github.com/spacebarchat/server/commit/51da17cf19d476483ee44e5f832d1ebdcd844f88 | [email protected] | Source CodeVendor |
| https://github.com/spacebarchat/server/security/advisories/GHSA-p5cf-7hg9-gf65 | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/spacebar-server-missing-authorization-via-member-ids-endpoint | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Spacebar Server | <= 51da17cf19d476483ee44e5f832d1ebdcd844f88 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |