CVE-2026-70618

Name of the Vulnerable Software and Affected Versions Spacebar Server versions prior to commit 51da17c

Description An authorization flaw allows authenticated users to enumerate the complete membership of a guild. By querying the 'GET /guilds/{guild id}/roles/{role id}/member-ids' endpoint, an attacker can retrieve a full list of member user IDs for any guild on the instance. This is possible because the route handler for this specific endpoint lacks the permission checks implemented in similar endpoints, requiring only a valid bearer token and a known guild id to exploit.

Recommendations Update Spacebar Server to commit 51da17c or a later version. As a temporary mitigation, restrict access to the 'GET /guilds/{guild id}/roles/{role id}/member-ids' endpoint.