Broken Access Control Vulnerability in Omnispace Agora Project
CVE-2026-63153

8.6HIGH

Key Information:

Vendor

Omnispace

Status
Agora Project
Vendor
CVE Published:
13 October 2026

What is CVE-2026-63153?

The Omnispace Agora Project prior to version 26.10.0 is susceptible to a broken access control vulnerability in the setAffectations() function. This flaw allows authenticated attackers to insert access-right records for any target space without sufficient verification of their privileges. As a result, attackers can manipulate access rights and gain unauthorized access to spaces that are intended to be restricted, effectively breaking tenant isolation and compromising the integrity of user permissions.

Affected Version(s)

Agora Project 0 < 26.10.0

References

https://github.com/xech/agora-project/releases/tag/26.10
release-notespatch
https://www.agora-project.net/
product
https://www.vulncheck.com/advisories/omnispace-agora-proj...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Geoffrey Robert of akailabs
.