CVE-2026-70618: Spacebar Server Auth Bypass Vulnerability

CVE-2026-70618 Overview

CVE-2026-70618 is a missing authorization vulnerability [CWE-862] in Spacebar Server, an open-source chat platform. The flaw affects versions before commit 51da17c. Any authenticated user holding a valid bearer token can enumerate the complete member list of any guild on the instance by calling the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint. The route handler skips the membership and permission checks enforced on sibling endpoints. Attackers only need a known guild ID to retrieve every member user ID, exposing private community rosters and enabling downstream reconnaissance.

Critical Impact
Authenticated users can enumerate the full membership of any guild on a Spacebar instance without being a member of that guild, breaking tenant isolation for private communities.

Affected Products

Spacebar Server versions before commit 51da17cf19d476483ee44e5f832d1ebdcd844f88
Self-hosted Spacebar chat instances exposing the /guilds/{guild_id}/roles/{role_id}/member-ids route
Deployments that rely on guild-level membership for access control to member rosters

Discovery Timeline

2026-08-05 - CVE-2026-70618 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70618

Vulnerability Analysis

Spacebar Server implements guild-scoped endpoints under src/api/routes/guilds/#guild_id/. Sibling routes verify that the requesting user belongs to the target guild before returning member data. The /roles/{role_id}/member-ids handler omitted that check.

A valid bearer token is the only prerequisite. Any account on the instance, including newly registered users, can query member IDs for arbitrary guilds. The response returns raw user IDs for every member holding the specified role, and abusing the @everyone role ID returns the full guild roster.

The exposed user IDs can be pivoted into follow-on requests against user-profile endpoints, enabling large-scale enumeration of private community populations. Confidentiality of membership metadata is broken, while integrity and availability are unaffected.

Root Cause

The root cause is a missing authorization control in the route handler. The function accepted guild_id and role_id from the URL and executed the database query without asserting that req.user_id was a member of guild_id. There was also no special handling for the @everyone role, whose ID matches the guild_id and represents the entire membership.

Attack Vector

The attack is network-based and requires only low-privilege authentication. An attacker registers or reuses any account on the target Spacebar instance, obtains a bearer token through normal login, and issues a single HTTP GET request with a known or guessed guild ID.

typescript

// Patch applied in src/api/routes/guilds/#guild_id/roles/#role_id/member-ids.ts
// Source: https://github.com/spacebarchat/server/commit/51da17cf19d476483ee44e5f832d1ebdcd844f88
 router.get("/", route({}), async (req: Request, res: Response) => {
     const { guild_id, role_id } = req.params as { [key: string]: string };
 
+    await Member.IsInGuildOrFail(req.user_id, guild_id);
+
+    // Does not return results for the @everyone role
+    if (guild_id == role_id) return res.json([]);
+
     // TODO: Is this route really not paginated?
     const members = await Member.find({
         select: { id: true },

The patch adds Member.IsInGuildOrFail to assert guild membership and short-circuits requests targeting the @everyone role.

Detection Methods for CVE-2026-70618

Indicators of Compromise

Repeated GET requests to /guilds/{guild_id}/roles/{role_id}/member-ids from a single authenticated session across many distinct guild_id values.
Requests to the member-ids endpoint originating from accounts that have no membership records in the queried guilds.
Large volumes of user-ID lookups following bursts of member-ids enumeration from the same bearer token.

Detection Strategies

Correlate application logs to flag callers of /roles/{role_id}/member-ids whose user_id does not appear in the members table for the queried guild_id.
Baseline normal API usage per account and alert on outliers that touch dozens of guild IDs in short time windows.
Review web server or reverse-proxy access logs for unusual fan-out patterns against the roles member-ids route path.

Monitoring Recommendations

Ship Spacebar API access logs to a central analytics platform and retain them for at least 90 days.
Add rate limiting and per-account request quotas on all /guilds/* routes to constrain enumeration.
Monitor authentication events for newly registered accounts that immediately begin issuing guild-scoped API calls.

How to Mitigate CVE-2026-70618

Immediate Actions Required

Upgrade Spacebar Server to a build that includes commit 51da17cf19d476483ee44e5f832d1ebdcd844f88 or later.
Audit access logs for prior calls to /guilds/{guild_id}/roles/{role_id}/member-ids and identify accounts that queried guilds they did not belong to.
Rotate bearer tokens for accounts observed enumerating the endpoint and review the associated user activity.

Patch Information

The fix is published in the upstream repository. See the GitHub commit for Spacebar Server, the GitHub Security Advisory GHSA-p5cf-7hg9-gf65, and the VulnCheck advisory on the missing authorization for details. The patch adds Member.IsInGuildOrFail and skips result generation when guild_id == role_id (the @everyone role).

Workarounds

Block or filter the /guilds/*/roles/*/member-ids path at a reverse proxy or WAF until the upgrade is deployed.
Restrict registration on public instances to reduce the pool of authenticated attackers.
Apply the upstream patch manually if a full version upgrade is not immediately feasible.

bash

# Example nginx workaround: block the vulnerable route until patched
location ~ ^/api/v[0-9]+/guilds/[^/]+/roles/[^/]+/member-ids$ {
    return 403;
}