CVE-2026-63153

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access...

CVE-2026-63153

The Omnispace Agora Project versions prior to 26.10.0 are susceptible to a broken access control vulnerability within the setAffectations() function. This flaw allows authenticated attackers to insert access-right records for a target space provided by the caller without the system verifying if t...

CVE-2026-63153 Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access...