Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-63153Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()

High 8.1

In plain English

A high-severity authorization bypass via user-controlled key in Agora Project from Omnispace. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 77.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.

Affected products (as reported)

Vendor	Product	Versions
Omnispace	Agora Project	0 – before 26.10.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Fixed Release Tag release-notes, patch
Project Webpage product
VulnCheck Advisory: Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations() third-party-advisory