Authorization Flaw in Deepstream Server Allows Modification of Protected Records
CVE-2026-63116
What is CVE-2026-63116?
A significant authorization flaw has been identified in Deepstream server versions 10.1.0 and 10.1.1. This issue arises from the omission of RECORD_ACTION.PATCH_MULTI in the RULES_MAP within the permission module. As a result, authenticated users with the permission type set to config can issue PATCH_MULTI record operations, leading to null rule specifications returned by getRulesForMessage. Consequently, ConfigPermission.canPerformAction misinterprets the situation as an unconditional allow. This flaw enables any authenticated user to alter critical protected records, potentially corrupting application state or disrupting services. Deployments with the default permission type set to none are particularly vulnerable, as they permit unrestricted access to all operations. The issue has been remedied in version 10.1.1.
Affected Version(s)
deepstream.io >= 10.1.0, < 10.1.1