CVE-2026-63163: Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running an Omnispace Agora Project version before 26.10.0 are affected if the MobileFileDownload route is reachable by an attacker. No authentication or user interaction is required.
What does an attacker need to retrieve files?
An attacker needs to guess or otherwise determine a target file name, then compute the MD5 hash of that filename to produce the token accepted by the route. The route does not perform a proper authorization check.
What is the impact of successful exploitation?
Successful exploitation allows unauthorized downloading of protected files, resulting in information disclosure. The supplied data does not indicate integrity or availability impact.
How can we remediate this vulnerability?
Upgrade Omnispace Agora Project to version 26.10.0 or later. The affected versions are those before 26.10.0.