CVE-2026-69114: Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass
Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGEMESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69114?
The severity of CVE-2026-69114 is medium with a score of 6.5.
What type of vulnerability is described in CVE-2026-69114?
CVE-2026-69114 describes a cross-channel message deletion vulnerability due to a permission check bypass.
Who is affected by CVE-2026-69114?
Authenticated users with MANAGE_MESSAGES permission in any controlled channel are affected by CVE-2026-69114.
How do I fix CVE-2026-69114?
To fix CVE-2026-69114, update Spacebar Server to the latest version that includes the patch for this vulnerability.
What actions can be exploited because of CVE-2026-69114?
CVE-2026-69114 allows users to delete messages across different channels without proper permissions.