CVE-2026-63172
7.1HighPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-862
Impact
Authenticated low-privileged users can create unauthorized accounts and escalate privileges on the platform. Attackers only need valid regular user credentials to exploit this over the network.
Root cause
The actionVueEditUser action fails to enforce authorization checks via editRight(), letting non-administrative users access account creation functionality.
Affected systems
Omnispace Agora Project versions prior to 26.10.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Fix & remediation
Upgrade Omnispace Agora Project to version 26.10.0 or later. If patching immediately is not possible, restrict untrusted user access or disable standard member account capabilities until updated.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.