Omnispace Agora Project: Broken access control in setAffectations()
Summary
Omnispace Agora Project versions before 26.10.0 contain a broken access control flaw in the setAffectations() function. An authenticated user can insert access-right records for a target space they do not control, which can assign access to spaces outside their own reach. This breaks tenant isolation and can grant unauthorized access to restricted spaces.
Affected
- Omnispace Agora Project, all versions from 0 up to but not including 26.10.0
Fixed in
- Version 26.10.0 or later (fixed version named in the CVE record)
- The upstream release page excerpt reviewed does not explicitly confirm the fix; verify against the current upstream release
Workaround
- Unknown. No vendor workaround was found in the sources.
- Until the upgrade is done, restrict account creation and manually review existing space-access rights (own suggestion, not from a source)
Exploitation
- No exploitation in the wild known; no CISA KEV entry and no public proof of concept found in the checked sources.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
Our recommendation
- Identify all Agora Project instances and confirm the running version.
- Upgrade to 26.10.0 or later, preferably the latest upstream 26.10.x release.
- On multi-client instances, review space memberships and access rights.
- Restrict account creation and monitor for unexpected access-right changes until patched.
- If a hosting provider operates the instance, ask whether it is patched.
- Check related reports CVE-2026-63174 and CVE-2026-63163 as well.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: Omnispace Agora Project broken access control via setAffectations() www.vulncheck.com
- Agora Project release 26.10 (GitHub) github.com
- Agora Project website www.agora-project.net
- OSV entry CVE-2026-63153 osv.dev
- Vulners CVE record CVE-2026-63153 vulners.com
- Softaculous: Agora Project updated to 26.10.0 www.softaculous.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:23.
Original description (NVD)
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.