Description
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.
Published: 2026-09-21
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Unauthorized Record Modification
Action: Immediate Patch
AI Analysis

Impact

deepstream’s Valve permission system mistakenly treats a missing rule specification as an unconditional allow when a user with the "config" permission type issues a PATCH_MULTI record operation. As a result, any authenticated user can perform PATCH_MULTI on protected records, corrupt application state, and disrupt service by modifying data they should not be able to change.

Affected Systems

This issue affects the deepstream.io server from deepstreamIO, specifically version 10.1.0. The vulnerability was resolved in version 10.1.1. Systems using the default permission type "none" are unaffected because they already allow all operations.

Risk and Exploitability

With a CVSS score of 8.8, the vulnerability is considered high risk. The EPSS score is not available and the vulnerability is not listed in CISA KEV. The attack vector is an authenticated user who can send a PATCH_MULTI request; no special privileges are required beyond authentication. Successful exploitation results in unauthorized writes to protected records, undermining data integrity and potentially causing service disruption.

Generated by OpenCVE AI on September 21, 2026 at 18:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update deepstream.io to version 10.1.1 or later.
  • Verify that the permission configuration is set to "config" and that the rules map includes all record actions, especially PATCH_MULTI.
  • Monitor logs for abnormal PATCH_MULTI requests and audit changes to protected records to detect any unauthorized activity.

Generated by OpenCVE AI on September 21, 2026 at 18:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Deepstreamio
Deepstreamio deepstream.io
Vendors & Products Deepstreamio
Deepstreamio deepstream.io

Mon, 21 Sep 2026 17:15:00 +0000

Type Values Removed Values Added
Description deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.
Title deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Deepstreamio Deepstream.io
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-21T17:59:34.586Z

Reserved: 2026-07-15T16:54:55.816Z

Link: CVE-2026-63116

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T17:17:38.510

Modified: 2026-09-21T18:17:09.873

Link: CVE-2026-63116

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T18:30:17Z

Weaknesses