What’s Vulnerable › Vulnerabilities

CVE-2026-63174: Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-27
• Weakness: CWE-862

Description

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

Affected products

• Omnispace Agora Project: before 26.10.0 — fixed in 26.10.0

How to fix

Upgrade to a fixed version: Omnispace Agora Project 26.10.0. Check the vendor advisory for mitigations.

References

• https://github.com/xech/agora-project/releases/tag/26.10
• https://www.agora-project.net/
• https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-spaceaffectlist

Get alerted when CVE-2026-63174 or the next vulnerability affects your stack