CVE-2026-63173
Omnispace Agora Project 26.10.0 Broken Access Control via isAutor()
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and authored objects can retain unauthorized read access to space objects even after being removed from the space, leading to persistent information disclosure.
| CWE | CWE-862 |
| Vendor | omnispace |
| Product | agora project |
| Published | Nov 13, 2026 |
| Last Updated | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for omnispace agora project
Be the first to know when new medium vulnerabilities affecting omnispace agora project are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Omnispace / Agora Project
0 ≤ 26.10.0
References
akailabs.fr: https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63173-stale-author-access-after-space-revocation-via-isautor agora-project.net: https://www.agora-project.net/ vulncheck.com: https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-isautor
Credits
Geoffrey Robert of akailabs Valentin Holubec of akailabs