Deepstream.Io
Approved changes feed: RSS · Atom
cpe:2.3:a:deepstreamio:deepstream.io:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Deepstreamio (ea3e1f5d-93ee-51a5-a7f5-2e9748aec344) |
|---|---|
| Product | Deepstream.Io (698a4346-a432-5c49-803e-de31c0234feb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-63116 |
vulnerable | 2026-10-13 12:28:38.615581 |
deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
HIGH (8.8)
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.
Published: 2026-09-21T16:59:22.958Z
Updated: 2026-09-21T17:59:34.586Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-49252 |
vulnerable | 2026-07-29 00:57:45.311412 |
deepstream is vulnerable to prototype pollution
CRITICAL (9.9)
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any record. This issue has been fixed in version 10.0.5.
Published: 2026-06-18T20:01:31.307Z
Updated: 2026-06-22T15:11:26.795Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.