CVE-2026-63163

Deferred Deferred - Pending Action

Broken Access Control in Omnispace Agora Project

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63163

EUVD

EUVD-2026-100576

Affected Vendors & Products

Vendor	Product	Version / Range
Omnispace	Agora	Project 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is a broken access control vulnerability in Omnispace Agora Project before version 26.10.0. It affects the MobileFileDownload route and allows unauthenticated attackers to download arbitrary files by generating an MD5 hash of a filename instead of using proper authorization. Attackers can guess filenames to create matching MD5 tokens and retrieve protected files without authentication.

Detection Guidance

To detect this vulnerability, check if the MobileFileDownload route in Omnispace Agora Project versions before 26.10.0 is accessible without proper authentication. Test by attempting to download files using MD5 hashes of filenames instead of valid tokens. Monitor logs for unauthorized file access attempts or unusual download patterns.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files stored on the system. Attackers could steal confidential data, intellectual property, or other protected information by downloading files they are not authorized to access. The impact includes potential data breaches and loss of sensitive information.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR and HIPAA by enabling unauthorized access to personal or health data. Such breaches may result in legal penalties, fines, and reputational damage due to failure to protect sensitive information as required by these standards.

Mitigation Strategies

Immediately upgrade Omnispace Agora Project to version 26.10.0 or later to patch the vulnerability. If immediate upgrade is not possible, restrict access to the MobileFileDownload route via network-level controls or disable the route until patched. Review and audit file access logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-63163. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70