CVE-2026-63153: falha de alta gravidade em Omnispace Agora Project
Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.3%
probabilidade de exploração
0.3%top 79% das CVEs
exploração observada
nãonenhuma fonte reporta
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Omnispace · Agora ProjectCVEs relacionadas — Omnispace Agora Project
No mesmo produto, das mais perigosas para as menos.
CVE-2026-63162HIGHOmnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName ParameterEPSS 0.7%CVE-2026-63146CRITICALOmnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.phpEPSS 0.7%CVE-2026-63154HIGHOmnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]EPSS 0.4%CVE-2026-63158CRITICALOmnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via CookiesEPSS 0.4%CVE-2026-63161HIGHOmnispace Agora Project < 26.10.0 Session Fixation via AuthenticationEPSS 0.4%CVE-2026-63149CRITICALOmnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()EPSS 0.4%