Spacebar Server releases preceding commit 8d126f4 expose their single‑delete and bulk‑delete message endpoints to a permission check bypass. The handlers do not enforce that the channel ID supplied in the delete request matches the channel context of the authenticated user, allowing a member with the MANAGE_MESSAGES role in any channel to issue deletion commands that affect arbitrary channels. The result is an unvalidated authorization flaw (CWE‑639) that lets a legitimate but potentially malicious user discreetly erase messages across the server, undermining message integrity and disrupting communications.

Spacebar Server, all versions before commit 8d126f4. No specific product or CPE details are given beyond the general Spacebar Server offerings.

The vulnerability receives a CVSS score of 7.1, indicating medium severity, and the EPSS score is unavailable; it is not listed in KEV. Exploitation requires an authenticated user in a channel with the MANAGE_MESSAGES permission. An attacker would send deletion requests through their own channel, which the vulnerable server then applies to any target channel. Because the attacker needs only legitimate channel-based permissions, the likelihood of exploitation is moderate, particularly in environments where many users have broad manage‑message rights.