CVE-2026-69114: Spacebar Server Auth Bypass Vulnerability

CVE-2026-69114 Overview

CVE-2026-69114 is a broken access control vulnerability in Spacebar Server, an open-source, Discord-compatible chat platform. The flaw affects versions prior to commit 8d126f4. The single-delete and bulk-delete message handlers fail to scope message queries to the requested channel. Authenticated users holding MANAGE_MESSAGES permission in any channel they control can delete arbitrary messages in other channels by routing delete requests through their own channel. The weakness maps to CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated user with MANAGE_MESSAGES permission in one controlled channel can delete arbitrary messages across the entire Spacebar Server instance, enabling cross-channel content destruction and moderation abuse.

Affected Products

Spacebar Server (spacebarchat/server) — all versions prior to commit 8d126f4
Single-delete message handler in src/api/routes/channels/#channel_id/messages/
Bulk-delete message handler in src/api/routes/channels/#channel_id/messages/bulk-delete.ts

Discovery Timeline

2026-08-10 - CVE-2026-69114 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-69114

Vulnerability Analysis

Spacebar Server exposes REST endpoints that accept a channel_id path parameter and a list of message IDs to delete. The authorization layer verifies that the caller holds MANAGE_MESSAGES in the channel identified by the URL path. However, the underlying delete query only filters by message ID and does not enforce that each supplied message belongs to that channel prior to the permission check taking effect.

An attacker with MANAGE_MESSAGES in a low-value or self-controlled channel can submit message IDs belonging to any other channel on the server. The database deletes those messages because the query scope is insufficient. This turns a channel-scoped moderation permission into a server-wide deletion primitive.

The issue affects both single-message and bulk-message deletion paths. Bulk deletion amplifies the impact by allowing many arbitrary messages to be removed in one request.

Root Cause

The root cause is a missing tenant-scoping constraint between the authorization check and the data-layer query. The permission check confirms authority over the request path's channel_id, while the delete operation operates on raw message IDs supplied by the client. The two contexts never converge to validate that the target messages actually belong to the authorized channel, an instance of [CWE-639].

Attack Vector

Exploitation requires network access and low-privilege authentication with MANAGE_MESSAGES in any single channel. No user interaction is required. The attacker crafts a bulk-delete request targeting their own controlled channel URL while embedding message IDs harvested from other channels or guilds.

typescript

// Patch from commit 8d126f4 — src/api/routes/channels/#channel_id/messages/bulk-delete.ts
            if (messages.length > maxBulkDelete) throw new HTTPError(`You cannot delete more than ${maxBulkDelete} messages`);
        }

-       await Message.delete({ id: In(messages), channel_id: channel_id });
+       const messageIdsInChannel = (await Message.find({ where: { id: In(messages), channel_id: channel_id }, select: { id: true } })).map((x) => x.id);
+
+       await Message.delete({ id: In(messageIdsInChannel), channel_id: channel_id });

        await emitEvent({
            event: "MESSAGE_DELETE_BULK",
            channel_id,
-           data: { ids: messages, channel_id, guild_id: channel.guild_id },
+           data: { ids: messageIdsInChannel, channel_id, guild_id: channel.guild_id },
        } satisfies MessageDeleteBulkEvent);

        res.sendStatus(204);

Source: GitHub Commit 8d126f4

The patch pre-filters supplied IDs with a Message.find scoped by both id and channel_id, then deletes only the intersection. The emitted MESSAGE_DELETE_BULK event also carries the filtered set, preventing information leaks about IDs in other channels.

Detection Methods for CVE-2026-69114

Indicators of Compromise

Unexpected MESSAGE_DELETE or MESSAGE_DELETE_BULK audit events referencing message IDs that were never posted in the channel where the deletion originated.
API access logs showing DELETE or POST requests to /channels/{channel_id}/messages/bulk-delete where the deleting user has MANAGE_MESSAGES only in low-activity or newly created channels.
User reports of missing messages in channels where the deleting actor has no assigned moderation role.

Detection Strategies

Correlate message-ID provenance against the channel_id in delete requests, alerting on any mismatch between the message's original channel and the request path.
Baseline bulk-delete request volume per user and flag anomalous spikes, especially from accounts with narrow permission scopes.
Monitor GitHub deployment metadata to identify instances still running Spacebar Server builds prior to commit 8d126f4.

Monitoring Recommendations

Enable verbose audit logging for all message-deletion API paths and forward events to a centralized log store.
Track MANAGE_MESSAGES permission grants and review any account holding this permission across multiple channels.
Alert on outbound event payloads where ids in MESSAGE_DELETE_BULK contain messages absent from the local channel history cache.

How to Mitigate CVE-2026-69114

Immediate Actions Required

Upgrade Spacebar Server to a build that includes commit 8d126f4 or later.
Audit recent MESSAGE_DELETE and MESSAGE_DELETE_BULK events for cross-channel anomalies and restore data from backups where possible.
Review and reduce the population of accounts holding MANAGE_MESSAGES to the minimum necessary.

Patch Information

The fix is committed in spacebarchat/server commit 8d126f4. It rewrites both delete handlers to filter incoming message IDs by channel_id at the data layer before invoking Message.delete. Additional context is available in the GitHub Security Advisory GHSA-62g6-28hv-h6hc and the VulnCheck advisory.

Workarounds

Deploy an API gateway rule that rejects bulk-delete requests where the count of message IDs exceeds a low threshold pending patch deployment.
Temporarily revoke MANAGE_MESSAGES from non-essential moderator accounts to shrink the attacker population.
Apply the two-line patch from commit 8d126f4 manually to both single-delete and bulk-delete handlers if a full upgrade is not yet feasible.

bash

# Fetch and apply the upstream fix
git fetch origin
git cherry-pick 8d126f401914d68fa8a97f7e5986dcfcc42de9a8
npm install && npm run build
# Restart the Spacebar Server process
systemctl restart spacebar-server