CVE-2026-63163
7.5HighPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-639
Impact
Unauthenticated remote attackers can download arbitrary files from the server. They only need network access to reach the MobileFileDownload route and compute the MD5 hash of target filenames.
Root cause
The MobileFileDownload endpoint uses a predictable md5(filename) token for access validation instead of performing an actual authorization check.
Affected systems
Omnispace Agora Project before 26.10.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade to Omnispace Agora Project 26.10.0 or later. If upgrading immediately is not possible, block or restrict external access to the MobileFileDownload route at your reverse proxy or web server.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure.