EUVD-2026-84001

deepstream: PATCHMULTI action bypasses Valve permission system allowing unauthorized record writes...

GHSA-89VX-JH4Q-VG3W deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

Summary The RECORDACTION.PATCHMULTI action is not registered in the Valve permission system's RULESMAP src/services/permission/valve/rules-map.ts. When ConfigPermission.canPerformAction is called for a PATCHMULTI message, getRulesForMessage returns null because the action is missing from the map...

CVE-2026-63116

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

CVE-2026-63116 deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

CVE-2026-63116 deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

CVE-2026-63116

The deepstream server (versions 10.1.0 through 10.1.1 ) contains a permission bypass vulnerability. The root cause is the omission of RECORD_ACTION.PATCH_MULTI from the RULES_MAP in src/services/permission/valve/rules-map.ts. When an authenticated user performs a PATCH_MULTI operation with permis...

CVE-2026-63116 deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...

CVE-2026-63116: Missing Authorization

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORDACTION.PATCHMULTI from RULESMAP. When an authenticated user sends a PATCHMULTI record operation whil...