CVE-2026-63174

Deferred Deferred - Pending Action

Broken Access Control in Omnispace Agora Project

Publication date: 2026-10-13

Last updated on: 2026-10-17

Assigner: VulnCheck

Description

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-17

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63174

EUVD

EUVD-2026-100580

Affected Vendors & Products

Vendor	Product	Version / Range
Omnispace	Agora	Project 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-63174 is a broken access control vulnerability in Omnispace Agora Project versions before 26.10.0. It allows a space administrator to assign users to spaces outside their authorized scope due to a missing verification of the caller's rights to the target space. The vulnerability stems from a missing readRight() check in the import flow's join INSERT operation, enabling attackers to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

Detection Guidance

To detect this vulnerability, check Omnispace Agora Project versions before 26.10.0. Verify if space administrators can assign users to unauthorized spaces by reviewing access logs for user-space assignments outside their scope. Look for missing readRight() checks in import flows or join INSERT operations.

Impact Analysis

This vulnerability can lead to unauthorized access and privilege escalation within the affected system. Attackers could exploit it to assign users to spaces they are not authorized to access, potentially gaining control over sensitive data or disrupting operations.

Compliance Impact

This vulnerability could lead to unauthorized access and privilege escalation, potentially violating data protection requirements under GDPR and HIPAA by allowing unauthorized users to access sensitive information across tenant spaces.

Mitigation Strategies

Immediately upgrade Omnispace Agora Project to version 26.10.0 or later. Review and restrict space administrator privileges to prevent unauthorized user assignments. Audit existing user-space assignments for anomalies and enforce strict tenant isolation policies.

Hi! I’m here to help you understand CVE-2026-63174. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70