Vulnerability-Lookup

CVE-2026-63116 (GCVE-0-2026-63116)

Vulnerability from cvelistv5 – Published: 2026-09-21 16:59 – Updated: 2026-09-21 17:59

Title

deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

Summary

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 17:59 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/deepstreamIO/deepstream.io/sec…	x_refsource_CONFIRM
https://github.com/deepstreamIO/deepstream.io/com…	x_refsource_MISC
https://github.com/deepstreamIO/deepstream.io/rel…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
deepstreamIO	deepstream.io	Affected: >= 10.1.0, < 10.1.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63116",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T17:59:12.110552Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T17:59:34.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "deepstream.io",
          "vendor": "deepstreamIO",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 10.1.0, \u003c 10.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T16:59:22.958Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w"
        },
        {
          "name": "https://github.com/deepstreamIO/deepstream.io/commit/1c2adde6581c53ef47e204364bc740bc3c2e2e2a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/deepstreamIO/deepstream.io/commit/1c2adde6581c53ef47e204364bc740bc3c2e2e2a"
        },
        {
          "name": "https://github.com/deepstreamIO/deepstream.io/releases/tag/v10.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/deepstreamIO/deepstream.io/releases/tag/v10.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-89vx-jh4q-vg3w",
        "discovery": "UNKNOWN"
      },
      "title": "deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63116",
    "datePublished": "2026-09-21T16:59:22.958Z",
    "dateReserved": "2026-07-15T16:54:55.816Z",
    "dateUpdated": "2026-09-21T17:59:34.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63116",
      "date": "2026-09-25",
      "epss": "0.00506",
      "percentile": "0.40677"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "deepstream.io",
                "vendor": "deepstreamIO",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 10.1.0, \u003c 10.1.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1."
          }
        ],
        "id": "CVE-2026-63116",
        "lastModified": "2026-09-24T21:25:27.050",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-63116",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T17:59:12.110552Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-21T17:17:38.510",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/deepstreamIO/deepstream.io/commit/1c2adde6581c53ef47e204364bc740bc3c2e2e2a"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/deepstreamIO/deepstream.io/releases/tag/v10.1.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-63116",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-21T17:59:12.110552Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-21T17:59:30.939Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "deepstream.io",
              "vendor": "deepstreamIO",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 10.1.0, \u003c 10.1.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-21T16:59:22.958Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w"
            },
            {
              "name": "https://github.com/deepstreamIO/deepstream.io/commit/1c2adde6581c53ef47e204364bc740bc3c2e2e2a",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/deepstreamIO/deepstream.io/commit/1c2adde6581c53ef47e204364bc740bc3c2e2e2a"
            },
            {
              "name": "https://github.com/deepstreamIO/deepstream.io/releases/tag/v10.1.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/deepstreamIO/deepstream.io/releases/tag/v10.1.1"
            }
          ],
          "source": {
            "advisory": "GHSA-89vx-jh4q-vg3w",
            "discovery": "UNKNOWN"
          },
          "title": "deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-63116",
        "datePublished": "2026-09-21T16:59:22.958Z",
        "dateReserved": "2026-07-15T16:54:55.816Z",
        "dateUpdated": "2026-09-21T17:59:34.586Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-63116

Vulnerability from fkie_nvd - Published: 2026-09-21 17:17 - Updated: 2026-09-24 21:25

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/deepstreamIO/deepstream.io/commit/1c2adde6581c53ef47e204364bc740bc3c2e2e2a
	security-advisories@github.com	https://github.com/deepstreamIO/deepstream.io/releases/tag/v10.1.1
	security-advisories@github.com	https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "deepstream.io",
          "vendor": "deepstreamIO",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 10.1.0, \u003c 10.1.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1."
    }
  ],
  "id": "CVE-2026-63116",
  "lastModified": "2026-09-24T21:25:27.050",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63116",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-21T17:59:12.110552Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-21T17:17:38.510",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/deepstreamIO/deepstream.io/commit/1c2adde6581c53ef47e204364bc740bc3c2e2e2a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/deepstreamIO/deepstream.io/releases/tag/v10.1.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-89VX-JH4Q-VG3W

Vulnerability from github – Published: 2026-09-22 19:56 – Updated: 2026-09-22 19:56

Summary

deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

Details

Summary

The RECORD_ACTION.PATCH_MULTI action is not registered in the Valve permission system's RULES_MAP (src/services/permission/valve/rules-map.ts). When ConfigPermission.canPerformAction() is called for a PATCH_MULTI message, getRulesForMessage() returns null because the action is missing from the map. This triggers an unconditional allow (callback(..., null, true)), completely bypassing all configured Valve permission rules.

Any authenticated user — regardless of their configured permissions — can write arbitrary data to any record using the PATCH_MULTI action.

Root Cause

In src/services/permission/valve/rules-map.ts lines 38-54, the RULES_MAP[TOPIC.RECORD].actions dictionary maps record actions to permission rule types. The actions registered include: SUBSCRIBE, SUBSCRIBEANDHEAD, SUBSCRIBEANDREAD, READ, HEAD, LISTEN, CREATE, UPDATE, PATCH, NOTIFY, DELETE, ERASE. However, RECORD_ACTION.PATCH_MULTI is absent from this map.

When getRulesForMessage() at line 86-99 encounters an action not in the map, it returns null. In config-permission.ts at line 88-93, when ruleSpecification === null, the callback is invoked with true (allow) unconditionally.

Attack Chain

Attacker authenticates with any valid credentials (even a minimal-privilege user)
Attacker sends a WebSocket message: {topic: RECORD, action: PATCH_MULTI, name: "admin/secret-record", parsedData: [{path: "role", data: "admin"}]}
message-processor.ts:68 invokes permission check
config-permission.ts:89 → getRulesForMessage() returns null for PATCH_MULTI
config-permission.ts:92 → unconditional ALLOW
Record transition applies the operations — arbitrary record is modified

Impact

Complete Valve permission bypass for record writes — all configured permission rules are irrelevant
Any authenticated user can overwrite any record, including admin-only records
Mass record overwrites can destroy application state, corrupt sessions, cause service outage
Only exploitable when permission.type is set to config (Valve) — the recommended production configuration per deepstream documentation
Default permission type none (OpenPermission) allows everything already, so default deployments are unaffected

Proof of Concept

// Connect as a minimal-privilege user
const { DeepstreamClient } = require('@deepstream/client');
const client = new DeepstreamClient('localhost:6020');
await client.login({ username: 'restricted-user', password: 'password' });

// This should be blocked by Valve permissions but isn't:
// Send raw PATCH_MULTI message to bypass all permission rules
const connection = client.getConnection();
connection.sendMessage({
  topic: 0x52, // TOPIC.RECORD
  action: 0x50, // RECORD_ACTION.PATCH_MULTI (check actual enum value)
  name: 'admin/protected-record',
  parsedData: [
    { path: 'permissions', data: 'admin' },
    { path: 'secret', data: 'overwritten' }
  ]
});

Suggested Fix

Add PATCH_MULTI to the RULES_MAP in src/services/permission/valve/rules-map.ts:

[RECORD_ACTION.PATCH_MULTI]: RULE_TYPES.WRITE,

This maps PATCH_MULTI operations to the same WRITE permission rule that governs UPDATE and PATCH.

Affected Versions

All versions that include PATCH_MULTI support with the Valve (ConfigPermission) permission system. The PATCH_MULTI action was added in commit 82ffa8119d8f4a8242ac5c3507469a22de746b65 but was never registered in RULES_MAP.

Credit

Vulnerability discovered by Zhixi "Jace" Sun of ASM/VI at TikTok.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@deepstream/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.1.0"
            },
            {
              "fixed": "10.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.1.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63116"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T19:56:34Z",
    "nvd_published_at": "2026-09-21T17:17:38Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `RECORD_ACTION.PATCH_MULTI` action is not registered in the Valve permission system\u0027s `RULES_MAP` (`src/services/permission/valve/rules-map.ts`). When `ConfigPermission.canPerformAction()` is called for a PATCH_MULTI message, `getRulesForMessage()` returns `null` because the action is missing from the map. This triggers an unconditional allow (`callback(..., null, true)`), completely bypassing all configured Valve permission rules.\n\nAny authenticated user \u2014 regardless of their configured permissions \u2014 can write arbitrary data to any record using the PATCH_MULTI action.\n\n## Root Cause\n\nIn `src/services/permission/valve/rules-map.ts` lines 38-54, the `RULES_MAP[TOPIC.RECORD].actions` dictionary maps record actions to permission rule types. The actions registered include: SUBSCRIBE, SUBSCRIBEANDHEAD, SUBSCRIBEANDREAD, READ, HEAD, LISTEN, CREATE, UPDATE, PATCH, NOTIFY, DELETE, ERASE. However, `RECORD_ACTION.PATCH_MULTI` is **absent** from this map.\n\nWhen `getRulesForMessage()` at line 86-99 encounters an action not in the map, it returns `null`. In `config-permission.ts` at line 88-93, when `ruleSpecification === null`, the callback is invoked with `true` (allow) unconditionally.\n\n## Attack Chain\n\n1. Attacker authenticates with any valid credentials (even a minimal-privilege user)\n2. Attacker sends a WebSocket message: `{topic: RECORD, action: PATCH_MULTI, name: \"admin/secret-record\", parsedData: [{path: \"role\", data: \"admin\"}]}`\n3. `message-processor.ts:68` invokes permission check\n4. `config-permission.ts:89` \u2192 `getRulesForMessage()` returns `null` for PATCH_MULTI\n5. `config-permission.ts:92` \u2192 unconditional ALLOW\n6. Record transition applies the operations \u2014 arbitrary record is modified\n\n## Impact\n\n- **Complete Valve permission bypass for record writes** \u2014 all configured permission rules are irrelevant\n- Any authenticated user can overwrite any record, including admin-only records\n- Mass record overwrites can destroy application state, corrupt sessions, cause service outage\n- Only exploitable when `permission.type` is set to `config` (Valve) \u2014 the recommended production configuration per deepstream documentation\n- Default permission type `none` (OpenPermission) allows everything already, so default deployments are unaffected\n\n\u003cdetails\u003e\u003csummary\u003eProof of Concept\u003c/summary\u003e\n\n```javascript\n// Connect as a minimal-privilege user\nconst { DeepstreamClient } = require(\u0027@deepstream/client\u0027);\nconst client = new DeepstreamClient(\u0027localhost:6020\u0027);\nawait client.login({ username: \u0027restricted-user\u0027, password: \u0027password\u0027 });\n\n// This should be blocked by Valve permissions but isn\u0027t:\n// Send raw PATCH_MULTI message to bypass all permission rules\nconst connection = client.getConnection();\nconnection.sendMessage({\n  topic: 0x52, // TOPIC.RECORD\n  action: 0x50, // RECORD_ACTION.PATCH_MULTI (check actual enum value)\n  name: \u0027admin/protected-record\u0027,\n  parsedData: [\n    { path: \u0027permissions\u0027, data: \u0027admin\u0027 },\n    { path: \u0027secret\u0027, data: \u0027overwritten\u0027 }\n  ]\n});\n```\n\u003c/details\u003e\n\n## Suggested Fix\n\nAdd `PATCH_MULTI` to the RULES_MAP in `src/services/permission/valve/rules-map.ts`:\n\n```typescript\n[RECORD_ACTION.PATCH_MULTI]: RULE_TYPES.WRITE,\n```\n\nThis maps PATCH_MULTI operations to the same WRITE permission rule that governs UPDATE and PATCH.\n\n## Affected Versions\n\nAll versions that include PATCH_MULTI support with the Valve (ConfigPermission) permission system. The PATCH_MULTI action was added in commit `82ffa8119d8f4a8242ac5c3507469a22de746b65` but was never registered in RULES_MAP.\n\n## Credit\n\nVulnerability discovered by Zhixi \"Jace\" Sun of ASM/VI at TikTok.",
  "id": "GHSA-89vx-jh4q-vg3w",
  "modified": "2026-09-22T19:56:34Z",
  "published": "2026-09-22T19:56:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63116"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deepstreamIO/deepstream.io/commit/1c2adde6581c53ef47e204364bc740bc3c2e2e2a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/deepstreamIO/deepstream.io"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deepstreamIO/deepstream.io/releases/tag/v10.1.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-63116 (GCVE-0-2026-63116)

FKIE_CVE-2026-63116

GHSA-89VX-JH4Q-VG3W

Summary

Root Cause

Attack Chain

Impact

Suggested Fix

Affected Versions

Credit

Tags

Sightings

Nomenclature

Related by attack behaviour