CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated attackers to exploit a missing authorization check in Spacebar Server, enabling them to join private group DM channels by sending unauthorized PUT requests. This can lead to unauthorized access to message histories, the ability to post messages as legitimate participants, and the potential to add third-party users without their consent. Organizations using Spacebar Server should prioritize patching this vulnerability to protect sensitive communications and prevent unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the unguarded PUT /channels/{channel_id}/recipients/{user_id} handler to join private group DMs, read complete message history, post messages as a participant, and force-add third-party users without their consent.