CVE-2026-63174 Omnispace CVE debrief

Who should care

Administrators and defenders of Omnispace Agora Project installations, especially those with multiple spaces and user assignments, should assess their exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-63174 is a high-severity vulnerability allowing unauthorized space administrators to assign users to spaces outside their authority. Defenders should prioritize patching or mitigating this vulnerability, especially for systems with multiple spaces and user assignments. The impact includes potential unauthorized user-space assignments and tenant isolation compromise. However, additional information from the vendor and other sources may be necessary for a comprehensive understanding.

• Potential unauthorized user-space assignments
• Tenant isolation compromise requires verification
• User assignment manipulation across unauthorized spaces
• Patching or mitigation priority is high

Technical summary

The Omnispace Agora Project before version 26.10.0 contains a broken access control vulnerability. This vulnerability allows a space administrator to assign users into spaces outside their authority due to the spaceAffectList affectation being performed without verifying the caller's rights to the target space. The issue arises from a missing readRight() check in the import flow's join INSERT operation.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for systems with multiple spaces and user assignments.

Recommended defensive actions

• Patch Agora Project to version 26.10.0 or later
• Review and restrict user-space assignments
• Monitor for suspicious user assignment activities
• Perform a thorough review of existing user-space assignments
• Implement additional logging and monitoring for user assignment changes
• Conduct a security audit to identify potential vulnerabilities
• Verify the effectiveness of compensating controls

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. However, additional information from the vendor and other sources may be necessary for a comprehensive understanding.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.