Broken Access Control in Omnispace Agora Project Affects Space Administrators

CVE-2026-63174

What is CVE-2026-63174?

The Omnispace Agora Project prior to version 26.10.0 is affected by a broken access control vulnerability. This issue allows space administrators to improperly assign users to spaces beyond their authorized access, as the spaceAffectList adjustment occurs without validating the caller's permissions for the target space. An attacker could capitalize on this flaw by exploiting the absence of a readRight() check within the import flow's join INSERT, thereby breaching tenant isolation and enabling manipulation of user-space assignments across unintended spaces.

References