CVE-2026-69114

MediumCVSS 6.5/10Last modified Sep 17, 2026

Description

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
Spacebar ServerSpacebar Server< 8d126f401914d68fa8a97f7e5986dcfcc42de9a8

References

Timeline

Published
Aug 10, 2026
Last modified
Sep 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-691156.5OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API eCVE-2026-691166.1FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can injecCVE-2026-691176.5NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to injeCVE-2026-691188.8Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users CVE-2026-691198.3Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to rCVE-2026-69128.8Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel beforCVE-2026-691276.9Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsaniCVE-2026-691284.6Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In 5.2.2, theCVE-2026-691295.8KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validaCVE-2026-69136.4The Shortcodely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'widget_area' parameter in all versions up to, andCVE-2026-691348.8SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the RECVE-2026-691358.8SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Pr