The spacebar Server exposes a missing authorization check in the /guilds/{guild_id}/roles/{role_id}/member-ids endpoint. Any authenticated user can query this route and receive a complete list of member user IDs for a guild they may not belong to. The exposed data can be used for targeted phishing, social engineering, or privacy violations. This flaw represents an authorization bypass through user‑controlled keys (CWE‑862).

All Spacebar Server releases before the commit 51da17cf on the master branch are affected. No specific version ranges are listed in the advisory, so all deployments prior to the patch are vulnerable. The fix is committed at 51da17cf and later.

The CVSS score of 5.3 reflects a moderate threat level. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, indicating no known widespread exploitation at this time. Attackers need only a valid bearer token for authentication, which can be obtained by compromising or otherwise authenticating a user. Once authenticated, the exploit is performed over the network via standard HTTP requests to the unprotected endpoint.