What’s Vulnerable › Vulnerabilities

CVE-2026-88817: Privilege escalation via legacy access group creation endpoint

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-16 · updated 2026-09-23
• Weakness: CWE-269

Description

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access to the application or its underlying host.

Affected products

• Curiosity GmbH Curiosity Workspace: 26.8.70362

References

• https://docs.curiosity.ai/security/advisories/cve-2026-88817

Get alerted when CVE-2026-88817 or the next vulnerability affects your stack