CVE-2026-69114

Name of the Vulnerable Software and Affected Versions Spacebar Server versions prior to commit 8d126f4

Description Authenticated users possessing the MANAGE MESSAGES permission in a channel they control can delete arbitrary messages in other channels. This occurs because the single-delete and bulk-delete message handlers fail to properly scope message queries to the requested channel, allowing delete requests to be routed through a controlled channel to bypass intended restrictions.

Recommendations Update Spacebar Server to commit 8d126f4 or a later version.