CVE-2026-63172: Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit

Q: What access does an attacker need to exploit this issue?

The attacker needs a regular, non-administrative member account. Exploitation does not require user interaction and can be performed remotely.

Q: Which deployments should be remediated?

Omnispace Agora Project versions before 26.10.0 are affected. Update to version 26.10.0 or later to obtain the authorization check.

Published Oct 13, 2026

Updated

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation.

Affected Software

1 affected component

Omnispace Agora Project<26.10.0

Event History

Oct 13, 2026

CVE Published

via MITRE·07:58 PM

Data Sourced

via MITRE·07:58 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs a regular, non-administrative member account. Exploitation does not require user interaction and can be performed remotely.

Which deployments should be remediated?