CVE-2026-63116 in Deepstream
Summary
by MITRE • 09/21/2026
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified within Deepstream versions ranging from 10.1.0 to 10.1.1 constitutes a critical authorization bypass rooted in an incomplete implementation of access control rules. The core technical flaw resides in the file src/services/permission/valve/rules-map.ts, where the system fails to include RECORD_ACTION.PATCH_MULTI within its defined RULES_MAP configuration. This omission creates a logic gap in how permission checks are evaluated for specific record operations. When an authenticated user attempts to execute a PATCH_MULTI operation on records governed by config permissions, the internal function getRulesForMessage is invoked to determine applicable access rules. Due to the missing entry in the map, this function returns a null rule specification rather than throwing an error or denying the request outright.
The severity of this flaw is exacerbated by how the downstream permission handler interprets this null result. The ConfigPermission.canPerformAction method treats a missing or null rule specification as an unconditional allow condition instead of defaulting to restrictive behaviors such as RULE_TYPES.WRITE. This design choice effectively creates a permissive fallback that bypasses intended security controls. Consequently, any authenticated user can manipulate arbitrary protected records by leveraging the PATCH_MULTI operation, which allows for bulk modifications. This capability enables attackers to corrupt application state, alter critical configuration data, or cause service disruption by modifying multiple records in a single request without proper authorization checks.
From an industry standard perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-732 Incorrect Permission Assignment for Critical Resource. The failure to explicitly deny access when rules are undefined represents a classic case of insecure default permissions. In the context of the MITRE ATT&CK framework, this behavior facilitates Privilege Escalation via Tactic TA0001 as it allows users to perform actions beyond their intended scope, and potentially Data Manipulation under TA0042 if the modified records affect system integrity or availability. The impact is particularly significant for deployments relying on config permissions, whereas those using the default permission type none are not additionally affected since they already permit all operations by design.
To mitigate this vulnerability, organizations must upgrade Deepstream to version 10.1.1 or later, where the missing RECORD_ACTION.PATCH_MULTI entry has been added to the RULES_MAP and the logic for handling null rule specifications has been corrected to enforce restrictive defaults. For environments that cannot immediately patch, implementing a Web Application Firewall with rules targeting suspicious PATCH_MULTI patterns on config-type records may provide temporary relief, though this is not a substitute for fixing the underlying code defect. Regular audits of permission configurations and ensuring that all record action types are explicitly defined in access control maps are essential practices to prevent similar authorization bypasses in future development cycles.