CVE-2026-63153: Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Omnispace Agora Projectto a version that resolves this vulnerability.Fixed in 26.10.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated and have low-level privileges. They can exploit the issue remotely without user interaction.
What is the impact on multi-tenant or restricted-space deployments?
An attacker can create access-right records for target spaces they are not authorized to manage. This can break tenant isolation and grant them unauthorized access to restricted spaces.
Which versions need remediation?
Omnispace Agora Project versions before 26.10.0 are affected. Upgrade to version 26.10.0 or later.
How can administrators identify possible exploitation?
Review access-right or affectation records for assignments created by users who did not have legitimate rights to administer the affected target spaces. Investigate any cross-tenant or otherwise unexpected assignments.