CVE-2026-9589
9.3CriticalPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-639, CWE-862
Impact
Authenticated attackers can view and modify configuration settings across other accounts, users, and tenants. They only need standard login access to the Collaboration Server.
Root cause
The Collaboration Server fails to perform authorization checks when running configuration cascade read and write operations against target entities.
Affected systems
Unblu Spark 7.0 through 8.36.1-hotfix.0 (on-premises and cloud deployments)
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade to a version newer than 8.36.1-hotfix.0 according to vendor bulletin UBL-2026-002; if patching immediately is not possible, restrict network access to trusted users and verify that non-default configuration validation settings are disabled.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities. The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope. Exploitation requires an authenticated session but no user interaction.