Authorization Bypass in Unblu Collaboration Server Affects Multiple Versions

CVE-2026-9589

What is CVE-2026-9589?

The Unblu Collaboration Server is susceptible to a missing authorization vulnerability that affects both on-premises and cloud deployments. In versions 7.0 through 8.36.1-hotfix.0 of Unblu Spark, authenticated users are able to access and manipulate configuration properties of various entities they should not have authorization to interact with. This flaw allows an attacker with a valid session to read and alter configurations belonging to other users and accounts, as well as affect other customers’ accounts in the Unblu Cloud environment. The lack of proper checks in the configuration cascade operations increases the risk of unauthorized data exposure and modifications, making it essential for affected users to implement the necessary security updates as advised by Unblu.

References