CVE-2026-70618
Received Received - Intake

Spacebar Server Guild Membership Enumeration Flaw

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: VulnCheck

Description
Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint without guild membership verification. Attackers can exploit the unprotected route handler in the roles member-ids endpoint, which lacks permission checks present in sibling endpoints, to retrieve the full list of member user IDs for any guild on the instance using only a valid bearer token and a known guild ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-06
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70618
EUVD
EUVD-2026-53605

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
spacebarchat spacebar_server to 51da17c (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Spacebar Server before commit 51da17c has a missing authorization vulnerability. Any authenticated user can list all guild members by querying an unprotected endpoint GET /guilds/{guild_id}/roles/{role_id}/member-ids without verifying guild membership. The endpoint lacks permission checks found in similar endpoints.

Detection Guidance

To detect this vulnerability, check if the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint is accessible without proper authorization. Use tools like curl to query the endpoint with a valid bearer token and guild ID. If the endpoint returns member IDs without requiring guild membership verification, the system is vulnerable.

Impact Analysis

An attacker with a valid account could enumerate all members of any guild on the server. This exposes sensitive information about user associations and potentially their identities, enabling further targeted attacks or privacy violations.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. It risks non-compliance with privacy requirements for user data handling and disclosure.

Mitigation Strategies

Apply the latest patch from Spacebar Server commit 51da17c or later. Ensure all endpoints enforce proper authorization checks. Review server logs for unauthorized access attempts to the vulnerable endpoint. Restrict access to sensitive guild data until the issue is resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70618. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart