CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users with MANAGE_MESSAGES permission to delete arbitrary messages across different channels due to insufficient scoping in the single-delete and bulk-delete message handlers. This could lead to unauthorized message removal, potentially disrupting communication and data integrity within the application. Organizations using Spacebar Server should prioritize addressing this issue to prevent misuse by privileged users.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGE_MESSAGES permission in any controlled channel can delete arbitrary messages in other channels by routing delete requests through their own channel.