Vulnerability · Published Sep 16, 2026 · Assigned by airbus

CVE-2026-88817Privilege escalation via legacy access group creation endpoint

High 8.7

In plain English

A high-severity privilege mismanagement in Curiosity Workspace from Curiosity GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access to the application or its underlying host.

Affected products (as reported)

Vendor	Product	Versions
Curiosity GmbH	Curiosity Workspace	26.8.70362

Weakness: CWE-269, CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://docs.curiosity.ai/security/advisories/cve-2026-88817 vendor-advisory