Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-69114

Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass

CVSS 4.0 7.1 HIGHCVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-69114

Published

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-69114

Published

Spacebar Server

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Spacebar Server",
                    "product": "Spacebar Server",
                    "defaultStatus": "affected",
                    "packageURL": "pkg:github/spacebarchat/server",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "versionType": "git",
                            "lessThan": "8d126f401914d68fa8a97f7e5986dcfcc42de9a8"
                        }
                    ],
                    "repo": "https://github.com/spacebarchat/server"
                }

Original source record · Cite this exact observation · Complete original publisher JSON