CVE-2026-63174

Katalog CVE

CVSS 8.1 · High

Kerentanan Missing Authorization. Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

Rincian

Terbit di NVD

13 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Received

CVSS 3.1

8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/xech/agora-project/releases/tag/26.10
• https://www.agora-project.net/
• https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-spaceaffectlist