CVE-2026-63116: CWE-862: Missing Authorization in deepstreamIO deepstream.io
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.
AI Analysis
Technical Summary
deepstream.io versions >=10.1.0 <10.1.1 contain a missing authorization flaw in the permission rules mapping (src/services/permission/valve/rules-map.ts) where the RECORD_ACTION.PATCH_MULTI action is omitted from RULES_MAP. When an authenticated user sends a PATCH_MULTI operation and permission.type is config, the system returns a null rule specification, causing ConfigPermission.canPerformAction to allow the action unconditionally instead of enforcing write permissions. This permits any authenticated user to modify arbitrary protected records, potentially corrupting application state or causing service disruption. Deployments using the default permission type 'none' are not additionally affected. The vulnerability is resolved in version 10.1.1.
Potential Impact
Any authenticated user can exploit this vulnerability to modify arbitrary protected records without proper authorization, leading to potential data corruption, unauthorized data changes, and service disruption. The confidentiality, integrity, and availability of the affected deepstream.io service are all impacted.
Mitigation Recommendations
Upgrade deepstream.io to version 10.1.1 or later, where this authorization issue is fixed. No other mitigations are indicated by the vendor advisory.
CVE-2026-63116: CWE-862: Missing Authorization in deepstreamIO deepstream.io
Description
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.
CVSS v3.1
Score 8.8high
Affected software
deepstreamIO
deepstream.io
pkg:github/deepstreamio/deepstream.ioRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
deepstream.io versions >=10.1.0 <10.1.1 contain a missing authorization flaw in the permission rules mapping (src/services/permission/valve/rules-map.ts) where the RECORD_ACTION.PATCH_MULTI action is omitted from RULES_MAP. When an authenticated user sends a PATCH_MULTI operation and permission.type is config, the system returns a null rule specification, causing ConfigPermission.canPerformAction to allow the action unconditionally instead of enforcing write permissions. This permits any authenticated user to modify arbitrary protected records, potentially corrupting application state or causing service disruption. Deployments using the default permission type 'none' are not additionally affected. The vulnerability is resolved in version 10.1.1.
Potential Impact
Any authenticated user can exploit this vulnerability to modify arbitrary protected records without proper authorization, leading to potential data corruption, unauthorized data changes, and service disruption. The confidentiality, integrity, and availability of the affected deepstream.io service are all impacted.
Mitigation Recommendations
Upgrade deepstream.io to version 10.1.1 or later, where this authorization issue is fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-15T16:54:55.816Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab1669555bf5e2cf5390e65
Added to database: 09/21/2026, 17:17:09 UTC
Last enriched: 09/21/2026, 17:31:41 UTC
Last updated: 09/22/2026, 01:42:58 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.