GHSA-89VX-JH4Q-VG3W deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

Summary The RECORDACTION.PATCHMULTI action is not registered in the Valve permission system's RULESMAP src/services/permission/valve/rules-map.ts. When ConfigPermission.canPerformAction is called for a PATCHMULTI message, getRulesForMessage returns null because the action is missing from the map...

CVE-2026-63116

The deepstream server (versions 10.1.0 through 10.1.1 ) contains a permission bypass vulnerability. The root cause is the omission of RECORD_ACTION.PATCH_MULTI from the RULES_MAP in src/services/permission/valve/rules-map.ts. When an authenticated user performs a PATCH_MULTI operation with permis...