CVE-2026-63153
8.1HighPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-639
Impact
Authenticated attackers can break tenant isolation and grant themselves unauthorized access to restricted spaces. They only need low-privilege network access to an existing account on the application.
Root cause
The setAffectations() function accepts a caller-supplied target space and inserts access records without verifying that the requesting user has administrative rights over that space.
Affected systems
Omnispace Agora Project versions prior to 26.10.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade to Omnispace Agora Project version 26.10.0 or later. No official interim workaround is documented, so restrict network access to trusted users until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.