CVE-2026-70617: Spacebar Server Auth Bypass Vulnerability

CVE-2026-70617 Overview

CVE-2026-70617 is a missing authorization vulnerability [CWE-862] in Spacebar Server versions prior to commit dcfd910. The flaw resides in the PUT /channels/{channel_id}/recipients/{user_id} handler, which fails to verify that the requesting user is a member of the target group direct message (DM) channel. Any authenticated attacker can add themselves or third parties to arbitrary group DMs. Once inside, the attacker can read complete message history, post messages as a participant, and force-add other users without consent.

Critical Impact
Authenticated attackers gain full read and write access to private group DM conversations and can silently insert unwanted users into those channels.

Affected Products

Spacebar Server (all versions before commit dcfd910)
Deployments built from spacebarchat/server prior to the security patch
Self-hosted Spacebar chat instances exposing the channels API

Discovery Timeline

2026-08-05 - CVE-2026-70617 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70617

Vulnerability Analysis

Spacebar Server exposes a REST endpoint that adds recipients to group DM channels. The handler in src/api/routes/channels/#channel_id/recipients.ts loads the channel and its recipient list, then proceeds to mutate the membership without confirming that the calling user is already a recipient. This omission collapses the trust boundary between channel members and unrelated authenticated users on the same server instance.

The attack requires only a valid session token and the numeric channel_id of a target group DM. An attacker can enumerate or guess channel identifiers, then issue a single PUT request to insert user_id values. Since the endpoint accepts arbitrary user_id targets, attackers can also weaponize the flaw to force-add third parties into hostile or harassing channels.

Root Cause

The root cause is an absent membership assertion in the recipients route. The handler retrieves channel.recipients from the database but never filters that collection against req.user_id before performing the add operation. As a result, authorization is effectively reduced to authentication, which does not meet the confidentiality requirements of a private group DM.

Attack Vector

The attack vector is network-based and requires low privileges (a valid authenticated account) and no user interaction. The attacker sends a crafted HTTP PUT request to the recipients endpoint targeting a channel they do not belong to.

typescript

// Security patch applied in commit dcfd910
// File: src/api/routes/channels/#channel_id/recipients.ts
            relations: { recipients: true },
        });

+        if (!channel.recipients || channel.recipients.length == 0 || channel.recipients.filter((r) => r.user_id == req.user_id).length == 0) {
+            throw DiscordApiErrors.UNKNOWN_CHANNEL; // TODO: is this the right error
+        }
+
        if (channel.type !== ChannelType.GROUP_DM) {
            const recipients = [...new Set([...(channel.recipients?.map((r) => r.user_id) || []), user_id])];

Source: GitHub Commit dcfd910. The patch enforces that the requesting user is listed among channel.recipients before any mutation occurs, returning UNKNOWN_CHANNEL otherwise to avoid leaking channel existence.

Detection Methods for CVE-2026-70617

Indicators of Compromise

HTTP PUT requests to /channels/{channel_id}/recipients/{user_id} where the requesting user does not appear in prior message history for that channel.
Sudden appearance of new participants in group DMs without an accompanying invitation event from an existing member.
Sequential or scripted enumeration of channel_id values from a single account within a short time window.

Detection Strategies

Correlate access logs for the recipients endpoint against channel membership records to flag additions performed by non-members.
Alert on 2xx responses to PUT /channels/*/recipients/* where the actor was not previously present in the channel_recipients table.
Baseline normal recipient-addition volume per user and flag statistical outliers, particularly requests spanning many distinct channel_id values.

Monitoring Recommendations

Forward Spacebar Server application logs and reverse-proxy access logs to a central analytics platform for query and retention.
Monitor the recipients route specifically, including HTTP method, status code, req.user_id, target channel_id, and target user_id.
Review historical logs since the deployment date of the vulnerable version to identify prior unauthorized additions.

How to Mitigate CVE-2026-70617

Immediate Actions Required

Upgrade Spacebar Server to a build that includes commit dcfd910 or later.
Audit group DM channel membership for unexpected recipients added prior to the upgrade and remove unauthorized users.
Rotate session tokens for accounts observed exploiting the endpoint and notify affected channel participants.

Patch Information

The fix is provided in Spacebar Server commit dcfd91035e3da42abf5f32d8d86a35219225b3d4. Additional details are available in the GitHub Security Advisory GHSA-g38j-78fh-jm74 and the VulnCheck Advisory. Operators should rebuild from source or pull the updated container image incorporating the patched recipients.ts handler.

Workarounds

Block or rate-limit the PUT /channels/{channel_id}/recipients/{user_id} route at a reverse proxy such as NGINX or Cloudflare until the patch is deployed.
Restrict access to the Spacebar Server API to trusted networks or authenticated internal users where feasible.
Temporarily disable group DM creation to reduce the population of channels that can be targeted.

bash

# Example NGINX block for the vulnerable route until patched
location ~ ^/api/v[0-9]+/channels/[0-9]+/recipients/[0-9]+$ {
    if ($request_method = PUT) {
        return 403;
    }
    proxy_pass http://spacebar_backend;
}