CVE-2026-70617

Name of the Vulnerable Software and Affected Versions Spacebar Server versions prior to commit dcfd910

Description An authorization flaw allows authenticated attackers to join arbitrary group direct message channels without membership verification. By sending a PUT request to the '/channels/{channel id}/recipients/{user id}' endpoint, an attacker can gain access to private group DMs, read the full message history, send messages as a participant, and add other users to the channel without their consent.

Recommendations Update Spacebar Server to commit dcfd910 or a later version. Restrict access to the '/channels/{channel id}/recipients/{user id}' endpoint to prevent unauthorized membership changes.