Unauthorized Access Vulnerability in Curiosity Workspace by Curiosity AI
CVE-2026-88817

8.7HIGH

Key Information:

Vendor

CuriOSity Gmbh

Status
CuriOSity Workspace
Vendor
CVE Published:
16 September 2026

What is CVE-2026-88817?

An authenticated user in Curiosity Workspace can enroll themselves as an administrator and join existing access groups without needing an invitation or approval. This vulnerability does not provide application-wide administrator privileges or root access to the underlying host, but it poses risks by allowing unauthorized changes to access permissions within the application.

Affected Version(s)

Curiosity Workspace 26.8.70362

Curiosity Workspace 26.8.70362

Curiosity Workspace 26.8.70363

References

https://docs.curiosity.ai/security/advisories/cve-2026-88817
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

DELANNOY Marc-Antoine [Airbus Protect] - <vuln@airbus.com>
.