# deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

PATCH_MULTI action missing from deepstream's Valve RULES_MAP caused unconditional allow, letting any authenticated user write arbitrary records.

- Payout: Research
- Severity: high
- Program: deepstream
- Found by: manus-use
- Disclosed: 2026-09-22
- CVE: CVE-2026-63116
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-89vx-jh4q-vg3w
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-89vx-jh4q-vg3w
- Tags: area:oss domain:oss impact:dos impact:integrity kind:research platform:ghsa sev:high tech:nodejs tech:websocket technique:incomplete-fix technique:source-review vuln:access-control vuln:auth-bypass

**Target:** deepstream server WebSocket record message handler / Valve permission system
**Root cause:** RECORD_ACTION.PATCH_MULTI was never registered in RULES_MAP[TOPIC.RECORD].actions, so getRulesForMessage() returns null and ConfigPermission.canPerformAction() treats null ruleSpecification as unconditional allow.
**Steps:**
1. Authenticate to the deepstream server as any minimal-privilege user.
2. Send a raw WebSocket message `{topic: RECORD, action: PATCH_MULTI, name: "admin/secret-record", parsedData: [{path: "role", data: "admin"}]}`.
3. message-processor.ts:68 invokes the permission check; config-permission.ts:89 gets null from getRulesForMessage() for PATCH_MULTI.
4. config-permission.ts:92 invokes callback with allow=true unconditionally.
5. Record transition applies the patch operations to the target record.
**How found:** Code review of the Valve permission rules map: noticed PATCH_MULTI was added in commit 82ffa811 but never registered in RULES_MAP, then traced getRulesForMessage() returning null into the unconditional allow branch in config-permission.ts.
**Exploitation:** Any authenticated user sends a crafted PATCH_MULTI record message over the WebSocket connection; because the permission check short-circuits to allow, the patch is applied to arbitrary records including admin-only ones, enabling mass overwrites of application state.
**Escalation:** Mass record overwrites across all records can corrupt sessions and destroy application state, causing service outage.
**Insight:** When a framework dispatches permissions via an action-to-rule lookup table, enumerate every action enum value against the map — newly added actions silently fall through to the default branch, and a null/undefined rule spec is often treated as allow rather than deny.