Spacebar-server Bypass allowing message deletion via permission check on wrong channel

Vulnerability Overview Title: Cross-channel message deletion via permission check on the wrong channel Description: The message deletion processor looks up and deletes messages using a global message ID, but incorrectly checks the permission for the channel provided in the request URL, rather than the channel to which the message actually belongs. A user possessing permission in any channel they control can delete arbitrary messages, even if those messages do not belong to that channel. Impact Scope Affected Package: Affected Version: commit 42406c1 Fixed Versions: 8d126401914d68fa8a97f7e59 86d0dc42d69a8 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Confidentiality: None - Integrity: High - Availability: None Remediation Fixed Versions: 8d126401914d68fa8a97f7e59 86d0dc42d69a8 POC Code Single Message Deletion Victim Creates Channel and Sends Message Attacker Confirms Message Visibility and Attempts Deletion Attacker Creates Own Channel and Deletes Victim's Message Bulk Message Deletion Observations Single Message Deletion: - Read message in victim channel: 200 - Delete via victim channel: 403 - Delete via attacker channel: 204 - Victim re-reads message: 404 Bulk Message Deletion: - Bulk delete via attacker channel: 204 - Victim msg1 after bulk delete: 404 - Victim msg2 after bulk delete: 404 Impact Any authenticated low-privilege user can delete any message in any channel or server within the instance, including those for which they are neither an administrator nor a member, provided they can access the target channel's ID (even if those channels are visible to no one). This is a cross-channel integrity and permission control bypass, allowing arbitrary deletion of others' content, and enabling large-scale message wiping via the bulk endpoint. No server configuration changes are required, as this behavior exists in the default code path.

Goal Reached Thanks to every supporter — we hit 100%!

Spacebar-server Bypass allowing message deletion via permission check on wrong channel

More from this source