Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M
CVE-2026-63116deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
High 8.8
In plain English
A high-severity missing authorization in deepstream.io from deepstreamIO. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @deepstream/server | 10.1.1 | GHSA-89vx-jh4q-vg3w |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| deepstreamIO | deepstream.io | >= 10.1.0, < 10.1.1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H