Executive brief
deepstream is a real-time data synchronization platform used to manage and distribute application state across clients and servers. The Valve permission system (the recommended production configuration) fails to validate PATCH_MULTI record modification requests, allowing any authenticated user to overwrite any record regardless of configured access controls. An attacker could modify critical application data, corrupt user sessions, or trigger service outages by exploiting this bypass.
Technical details
The vulnerability is a permission system misconfiguration: the RECORD_ACTION.PATCH_MULTI action is not listed in the RULES_MAP dictionary within the Valve permission validator. When canPerformAction() processes a PATCH_MULTI message, getRulesForMessage() returns null (action not found), triggering an unconditional allow in config-permission.ts. The attack requires network access to the deepstream server and prior authentication with any valid user account. An attacker can craft and send a WebSocket message with topic RECORD, action PATCH_MULTI, targeting any record name, to modify arbitrary data fields. The fix is a one-line addition mapping RECORD_ACTION.PATCH_MULTI to RULE_TYPES.WRITE in rules-map.ts. This vulnerability only affects deployments using permission.type set to 'config' (Valve); deployments using the default 'none' permission type are unaffected.
Affected products
- deepstream deepstream All versions with PATCH_MULTI support when using Valve (ConfigPermission) permission system
Timeline
- 2026-09-22: disclosed: Vulnerability published as GHSA-89vx-jh4q-vg3w
- 2026-09-22: other: CVE-2026-63116 assigned