CVE-2026-63164: Omnispace Agora Project 26.10.0 IDOR via reloadMailTypeId Parameter
Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated with a valid account and able to send requests containing the reloadMailTypeId parameter. No user interaction is required.
What information can be exposed?
The flaw allows an authenticated user to manipulate a mail identifier and retrieve the title and body of private mail belonging to other users. The impact is unauthorized disclosure of sensitive communications; integrity and availability impact are not described.
How can teams determine whether they are affected?
Systems running Omnispace Agora Project through version 26.10.0 are affected according to the available information. A safe validation should confirm whether an authenticated low-privilege account can request a different user's mail identifier through reloadMailTypeId and receive that message's title or body.
What can be done if patching is not immediately possible?
The available information does not identify a vendor workaround. Restrict access to authenticated accounts as much as possible and monitor for requests that manipulate reloadMailTypeId values to reference mail objects belonging to other users.