Skip to main content

CVE-2026-63116: CWE-862: Missing Authorization in deepstreamIO deepstream.io

0
High
VulnerabilityCVE-2026-63116cvecve-2026-63116cwe-862
Published: 09/21/2026 (09/21/2026, 16:59:22 UTC)
Source: CVE Database V5
Vendor/Project: deepstreamIO
Product: deepstream.io

Description

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.

CVSS v3.1

Score 8.8high

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

deepstreamIO

deepstream.io

Affected versions
>=10.1.0 <10.1.1
GitHub Actionsmore threats →ai
deepstreamio/deepstream.io
pkg:github/deepstreamio/deepstream.io
Affected versions
>=10.1.0 <10.1.1

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 09/21/2026, 17:31:41 UTC

Technical Analysis

deepstream.io versions >=10.1.0 <10.1.1 contain a missing authorization flaw in the permission rules mapping (src/services/permission/valve/rules-map.ts) where the RECORD_ACTION.PATCH_MULTI action is omitted from RULES_MAP. When an authenticated user sends a PATCH_MULTI operation and permission.type is config, the system returns a null rule specification, causing ConfigPermission.canPerformAction to allow the action unconditionally instead of enforcing write permissions. This permits any authenticated user to modify arbitrary protected records, potentially corrupting application state or causing service disruption. Deployments using the default permission type 'none' are not additionally affected. The vulnerability is resolved in version 10.1.1.

Potential Impact

Any authenticated user can exploit this vulnerability to modify arbitrary protected records without proper authorization, leading to potential data corruption, unauthorized data changes, and service disruption. The confidentiality, integrity, and availability of the affected deepstream.io service are all impacted.

Mitigation Recommendations

Upgrade deepstream.io to version 10.1.1 or later, where this authorization issue is fixed. No other mitigations are indicated by the vendor advisory.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Data Version
5.2
Assigner Short Name
GitHub_M
Date Reserved
2026-07-15T16:54:55.816Z
Cvss Version
3.1
State
PUBLISHED

Threat ID: 6ab1669555bf5e2cf5390e65

Added to database: 09/21/2026, 17:17:09 UTC

Last enriched: 09/21/2026, 17:31:41 UTC

Last updated: 09/22/2026, 01:42:58 UTC

Views: 12

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses