Authorization Bypass in Spacebar Server via Channel Recipient Endpoint

Spacebar Server, an open-source communication platform, contains a missing authorization vulnerability (CVE-2026-70617) affecting versions prior to commit dcfd910. The vulnerability resides in the channel recipient endpoint, which fails to perform necessary membership verification during PUT requests. An authenticated attacker can exploit this flaw to inject themselves into private group direct message channels. Once a member, the attacker gains access to the entire historical message log of the private conversation, can read ongoing communications, and has the ability to post messages as a participant. Furthermore, the attacker can force-add third-party users into the private channel without their consent. This vulnerability poses a significant risk to the confidentiality and integrity of private user communications within the affected platform instances.

Attack Chain

1. Attacker authenticates to the target Spacebar Server instance using a standard, valid user account.
2. Attacker performs enumeration to identify the channel_id of a target private group DM or private channel.
3. Attacker constructs a malicious HTTP PUT request targeting the /channels/{channel_id}/recipients/{user_id} endpoint.
4. The server receives the PUT request but fails to perform an authorization check to verify if the requester has the authority to add a recipient to the specific channel.
5. The server updates the channel's recipient list to include the attacker's user_id or a targeted third-party user_id.
6. The attacker gains full access to the channel's message history and communication context.
7. Attacker proceeds to exfiltrate private conversation data or send fraudulent messages within the compromised channel.

Impact

Successful exploitation allows unauthorized access to private, restricted communication channels. An attacker can read sensitive message history, impersonate legitimate users within the context of the chat, and disrupt communications by force-adding arbitrary users. This impacts the confidentiality and integrity of private user discussions.

Recommendation

• Update Spacebar Server to commit dcfd910 or higher immediately.
• Monitor server logs for an unusual volume of PUT requests to /channels/ followed by /recipients/.
• Audit existing group DM channel membership lists for unexpected participants.
• Implement request rate limiting on the recipient management endpoint to detect or prevent rapid exploitation attempts.