High severity · published Oct 13, 2026
CVE-2026-63153
Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Agora Project · Omnispace
before 26.10.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63153
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63153
release-notes
https://github.com/xech/agora-project/releases/tag/26.10
product
https://www.agora-project.net/
third-party-advisory
https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-setaffectations
More from Agora Project
9.8
CVE-2026-63146
Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php
8.8
CVE-2026-63161
Omnispace Agora Project < 26.10.0 Session Fixation via Authentication
8.8
CVE-2026-63162
Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter
8.8
CVE-2026-63154
Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
8.1
CVE-2026-63174
Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList