CVE-2026-63172

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight enforcement in...

CVE-2026-63172 Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight enforcement in...

CVE-2026-63172

The Omnispace Agora Project versions prior to 26.10.0 are vulnerable to a broken access control flaw. The issue stems from a missing function-level authorization check specifically within the actionVueEditUser component, where the editRight() enforcement is absent. This allows a regular, non-admi...