Missing Authorization Vulnerability in Spacebar Server

CVE-2026-70618

What is CVE-2026-70618?

Spacebar Server prior to commit 51da17c contains a security flaw that permits authenticated users to enumerate full guild membership. This vulnerability arises from a lack of authorization checks on the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint. Attackers can exploit this unprotected endpoint to acquire an exhaustive list of user IDs belonging to any guild by simply possessing a valid bearer token and knowledge of a guild ID. This oversight allows malicious actors to gather sensitive member information without appropriate membership verification.

References