CVE-2026-63163

The Omnispace Agora Project before version 26.10.0 is vulnerable to a broken access control flaw in the MobileFileDownload route. The root cause is that the system relies on a predictable md5(filename) token for access rather than performing a proper authorization check. This allows unauthenticat...

CVE-2026-63163 Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5filename token instead of passing a proper authorization check. Attackers can guess or determi...