Broken Access Control Vulnerability in Omnispace Agora Project
CVE-2026-63172

7.1HIGH

Key Information:

Vendor

Omnispace

Status
Agora Project
Vendor
CVE Published:
13 October 2026

What is CVE-2026-63172?

The Omnispace Agora Project, prior to version 26.10.0, is susceptible to a broken access control vulnerability that enables a non-administrative user to create accounts by improperly leveraging the user-edit action. This vulnerability arises from the lack of adequate authorization checks in the editRight() function within actionVueEditUser. Consequently, attackers can exploit this flaw, leading to unauthorized user account creation and potential privilege escalation risks.

Affected Version(s)

Agora Project 0 < 26.10.0

References

https://github.com/xech/agora-project/releases/tag/26.10
release-notespatch
https://www.agora-project.net/
product
https://www.vulncheck.com/advisories/omnispace-agora-proj...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Geoffrey Robert of akailabs
.