CVE-2026-63173 Omnispace Agora Project 26.10.0 Broken Access Control via isAutor()

Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and...