Unblu Spark: Missing authorization in configuration cascade operations
Summary
Unblu Spark's Collaboration Server does not check whether a user may access the entity a configuration belongs to when reading or changing configuration. An authenticated user can read and modify configuration properties of other users, other accounts and, in Unblu Cloud, other customers. With certain non-default validation settings, a registered user can also write configuration properties they are not allowed to edit, in any scope. No user interaction is required.
Affected
- Unblu Spark 7.0 through 8.36.1-hotfix.0 (on-premises and Unblu Cloud, per the CVE description)
- CNA version data: 7.0 to below 8.37.0 (default configuration unaffected)
- Vendor bulletin UBL-2026-002: 8.36.1-hotfix.0 and all earlier versions
- Severity: 8.9 High (on-premises), 9.3 Critical (Unblu Cloud); CVSS v4.0 9.3 from the CNA
Fixed in
- Unblu Spark 8.37.2 and all later versions
- Unblu Spark 7.x: no fix available; the vendor's CNA record states there is no fix for 7.x
- Unblu Cloud: fix already deployed
Workaround
- None for on-premises deployments, according to the CNA record
- Unblu Cloud customers need not take any action
Exploitation
- Authenticated session required; no user interaction needed
- CISA SSVC assessment: exploitation none, not automatable, total technical impact
- No public proof of concept or evidence of exploitation found at the time of research
- Discovered via bug bounty (YesWeHack)
Our recommendation
- Upgrade on-premises Unblu Spark to 8.37.2 or later after verifying the version and test in a staging environment
- For Unblu Spark 7.x, ask Unblu for a support statement and a migration path, as no fix is available
- Review which accounts hold valid logins and remove unused or unnecessary accounts
- Review configuration-change logs for unexpected changes
- Unblu Cloud customers: no action needed
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Unblu security bulletin UBL-2026-002 docs.unblu.com
- Unblu security bulletins index docs.unblu.com
- BACS CVE records www.bacs.admin.ch
- vulners CVE record CVE-2026-9589 vulners.com
- OpenCVE CVE-2026-9589 app.opencve.io
- VulDB entry 422767 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:06.
Original description (NVD)
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities. The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope. Exploitation requires an authenticated session but no user interaction.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.