CVE-2026-70618

Katalog CVE

CVSS 4.3 · Medium EPSS 0,33%

Kerentanan Missing Authorization. Skor CVSS 3.1 4.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint without guild membership verification. Attackers can exploit the unprotected route handler in the roles member-ids endpoint, which lacks permission checks present in sibling endpoints, to retrieve the full list of member user IDs for any guild on the instance using only a valid bearer token and a known guild ID.

Rincian

Terbit di NVD

5 Agustus 2026

Terakhir diubah

16 September 2026

Status NVD

Deferred

CVSS 3.1

4.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/spacebarchat/server/commit/51da17cf19d476483ee44e5f832d1ebdcd844f88
• https://github.com/spacebarchat/server/security/advisories/GHSA-p5cf-7hg9-gf65
• https://www.vulncheck.com/advisories/spacebar-server-missing-authorization-via-member-ids-endpoint