CVE-2026-63116: deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULETYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
deepstreamto a version that resolves this vulnerability.Fixed in 10.1.1 - Compensating control
For deepstream deployments using deepstream 10.1.0 (vulnerable range “From 10.1.0 until 10.1.1”), restrict or block authenticated client PATCH_MULTI record operations until you upgrade to version 10.1.1, to prevent bypass of the Valve permission system and unauthorized record writes.
Event History
Frequently Asked Questions
Which deployments require remediation?
Deployments running deepstream versions 10.1.0 through versions before 10.1.1 are affected when permission.type is set to config. Deployments using the default permission type none already allow all operations and are not additionally affected by this issue.
What does an attacker need to exploit this issue?
An attacker needs an authenticated deepstream user account. No additional privileges or user interaction are required, and the attacker can use a PATCH_MULTI record operation to modify protected records.
How should affected deployments be remediated?
Upgrade deepstream to version 10.1.1, which fixes the missing PATCH_MULTI permission-rule mapping.