Vulnerability · Published Aug 10, 2026 · Assigned by VulnCheck

CVE-2026-69114Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in Spacebar Server from Spacebar Server. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 66.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.

Affected products (as reported)

Vendor	Product	Versions
Spacebar Server	Spacebar Server	0 – before 8d126f401914d68fa8a97f7e5986dcfcc42de9a8

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-62g6-28hv-h6hc) vendor-advisory, exploit
Researcher Disclosure technical-description, exploit, issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/spacebar-server-cross-channel-message-deletion-via-permission-check-bypass third-party-advisory