EUVD-2026-125584

Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj without a readRight ownership check in CtrlMail.php...

CVE-2026-63164

Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj without a readRight ownership check in CtrlMail.php...

CVE-2026-63164

The Omnispace Agora Project (through version 26.10.0 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because the Ctrl::getCurObj() function in CtrlMail.php fails to perform a readRight() ownership check when processing the reloadMailTypeId parameter. This allows au...

CVE-2026-63164 Omnispace Agora Project 26.10.0 IDOR via reloadMailTypeId Parameter

Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj without a readRight ownership check in CtrlMail.php...