Vulnerability · Published Aug 5, 2026 · Assigned by VulnCheck

CVE-2026-70618Spacebar Server Missing Authorization via member-ids Endpoint

Medium 4.3

In plain English

A medium-severity missing authorization in Spacebar Server from Spacebar Server. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 73.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint without guild membership verification. Attackers can exploit the unprotected route handler in the roles member-ids endpoint, which lacks permission checks present in sibling endpoints, to retrieve the full list of member user IDs for any guild on the instance using only a valid bearer token and a known guild ID.

Affected products (as reported)

Vendor	Product	Versions
Spacebar Server	Spacebar Server	0 – through 51da17cf19d476483ee44e5f832d1ebdcd844f88

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-p5cf-7hg9-gf65) vendor-advisory
Patch Commit patch
https://www.vulncheck.com/advisories/spacebar-server-missing-authorization-via-member-ids-endpoint third-party-advisory