Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.
CVE-2026-63153
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-63153
Agora Project
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/xech/agora-project",
"vendor": "Omnispace",
"product": "Agora Project",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "26.10.0",
"versionType": "semver"
}
],
"packageURL": "pkg:github/xech/agora-project",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-63153
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #22133 · Revision 1
- Added to Heist Feed
- Publisher date