{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-63116/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:deepstream:server:10.1.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-63116"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["deepstream/server (v10.1.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","authorization-bypass","cve-2026-63116"],"_cs_type":"advisory","_cs_vendors":["deepstream"],"content_html":"\u003cp\u003eDeepstream servers using the Valve (ConfigPermission) permission system are vulnerable to an authorization bypass due to a configuration oversight in the \u003ccode\u003esrc/services/permission/valve/rules-map.ts\u003c/code\u003e file. The \u003ccode\u003eRECORD_ACTION.PATCH_MULTI\u003c/code\u003e action, introduced in recent versions, was never registered in the \u003ccode\u003eRULES_MAP\u003c/code\u003e used by the system to evaluate user permissions.\u003c/p\u003e\n\u003cp\u003eWhen the server receives a \u003ccode\u003ePATCH_MULTI\u003c/code\u003e message, the \u003ccode\u003egetRulesForMessage()\u003c/code\u003e function fails to find a corresponding rule mapping and returns \u003ccode\u003enull\u003c/code\u003e. The system's security logic is designed to treat a \u003ccode\u003enull\u003c/code\u003e result as an unconditional allow, effectively bypassing all configured Valve permission rules. This allows any successfully authenticated user, regardless of their defined access level, to write arbitrary data to any record in the system. This vulnerability impacts production environments using the Valve permission model, potentially leading to unauthorized data modification, privilege escalation through record manipulation, and system-wide service disruption.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs authentication against the deepstream server using valid, low-privilege credentials.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious WebSocket message with \u003ccode\u003etopic: RECORD\u003c/code\u003e and \u003ccode\u003eaction: PATCH_MULTI\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker specifies a target record name (e.g., \u0026quot;admin/secret-record\u0026quot;) and malicious \u003ccode\u003eparsedData\u003c/code\u003e in the message payload.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003emessage-processor.ts\u003c/code\u003e service receives the request and triggers a permission evaluation call to \u003ccode\u003eConfigPermission.canPerformAction()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe permission service invokes \u003ccode\u003egetRulesForMessage()\u003c/code\u003e to retrieve the policy for \u003ccode\u003ePATCH_MULTI\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003egetRulesForMessage()\u003c/code\u003e fails to find the action in the \u003ccode\u003eRULES_MAP\u003c/code\u003e and returns \u003ccode\u003enull\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003econfig-permission.ts\u003c/code\u003e logic evaluates the \u003ccode\u003enull\u003c/code\u003e result and defaults to an unconditional grant of access.\u003c/li\u003e\n\u003cli\u003eThe server performs the record operation, modifying the target resource as requested by the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows any authenticated user to bypass all configured security policies, granting them write access to sensitive records and administrative data. Impact includes full data integrity loss, unauthorized privilege escalation if permission records are stored in deepstream, and potential application-level denial of service due to record corruption. Only deployments configured with \u003ccode\u003epermission.type: 'config'\u003c/code\u003e are affected.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all instances of \u003ccode\u003e@deepstream/server\u003c/code\u003e to the version containing the fix for CVE-2026-63116.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, apply a manual patch to \u003ccode\u003esrc/services/permission/valve/rules-map.ts\u003c/code\u003e to include \u003ccode\u003e[RECORD_ACTION.PATCH_MULTI]: RULE_TYPES.WRITE\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit application record logs for suspicious \u003ccode\u003ePATCH_MULTI\u003c/code\u003e operations originating from low-privilege service accounts or users.\u003c/li\u003e\n\u003cli\u003eImplement strict network-level segmentation to limit the reach of authenticated users to internal deepstream management records.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-23T01:59:03Z","date_published":"2026-09-23T01:59:03Z","id":"https://feed.craftedsignal.io/briefs/2026-09-deepstream-valve-bypass/","summary":"The deepstream server contains a vulnerability where the PATCH_MULTI action is missing from the Valve permission system's rule map, resulting in an unconditional allow for any authenticated user to perform unauthorized record writes.","title":"deepstream Valve Permission System Bypass via PATCH_MULTI","url":"https://feed.craftedsignal.io/briefs/2026-09-deepstream-valve-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-63116","version":"https://jsonfeed.org/version/1.1"}