Summary
CVE-2026-63174 is a high-severity broken access control vulnerability in Omnispace Agora Project, classified as CWE-862 (Missing Authorization), affecting all versions before 26.10.0. The flaw lives in the spaceAffectList affectation: the operation that assigns users into spaces was performed without verifying the caller’s rights to the target space. Concretely, the import flow’s join INSERT executes without the readRight() check that should gate it, so a space administrator can assign users into spaces entirely outside their authority.
The security consequence is a broken tenant isolation model: user-space assignments can be manipulated across unauthorized spaces, meaning the boundary between spaces stops being enforced at the database write that defines membership. The vulnerability scores 8.6 (HIGH) under CVSS 4.0 with the vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N — network-exploitable, low attack complexity, low privileges required, no user interaction, high confidentiality and integrity impact, and no availability impact. The fix ships in version 26.10.0, published as release tag 26.10 on the project’s GitHub repository.
Technical Analysis
CWE-862, the weakness class assigned to this CVE, describes a product that does not perform an authorization check when an actor attempts to access a resource or perform an action. That distinction matters. An improper authorization flaw means a check exists but is flawed; a missing authorization flaw means no check runs at all. In CVE-2026-63174 the description is explicit: the spaceAffectList affectation was performed without verifying the caller’s rights to the target space. The check is not weak or bypassable — on this path, it simply never executes.
The description names three code-level elements that together define the vulnerability’s anatomy:
spaceAffectList— the affectation routine that assigns users into spaces. This is the operation the attacker drives.- The import flow — the code path in which the vulnerable write occurs. The description pins the flaw to the import flow specifically, not to every affectation path.
- The join INSERT — the database write that binds a user to a space. This is the moment the unauthorized assignment becomes persistent state.
The missing gate is readRight(). Before a caller writes a user into a target space, the code should verify that the caller holds rights on that target space. Because the import flow’s join INSERT performs the write without calling readRight(), the write proceeds for whatever target space the caller names, regardless of whether the caller holds any authority over it. The result, as the description states, is that a space administrator can assign users into spaces outside their authority.
Why is a user-space assignment write security-critical? In a space-structured collaboration product, the space is the unit of access control. Membership rows — the user-to-space bindings this INSERT creates — define who can see and participate in what. When the write that creates those bindings can cross space boundaries without a rights check, the model inverts: instead of assignments reflecting delegated authority, authority becomes whatever the caller writes. The description characterizes the outcome as breaking tenant isolation. Once a space administrator can populate a space they do not govern, the space boundary is no longer a boundary.
The CVSS 4.0 vector breaks down as follows:
- AV:N (Network) — the attack surface is reachable over a network. The affectation is a normal application operation driven by an authenticated role, not a local-only function.
- AC:L (Low complexity) — the description identifies no race condition, timing window, or special precondition. The caller performs the affectation against a target space and the write lands.
- AT:N (No exploitable conditions) — no additional attack prerequisites beyond the stated role are rated.
- PR:L (Low privileges) — the described attacker is a space administrator: an authenticated role below global administration, not an unauthenticated outsider.
- UI:N (No user interaction) — the administrator’s own request drives the write; no victim needs to click, approve, or be present.
- VC:H / VI:H (High confidentiality and integrity impact) — the integrity impact is direct: user-space assignment data is manipulated across unauthorized spaces. The high confidentiality rating is consistent with the tenant-isolation breakage the description describes, although the advisory data does not enumerate specific downstream data exposure; details are not fully disclosed.
- VA:N (No availability impact) — nothing in the description indicates a denial-of-service effect; the flaw is an unauthorized write, not a crash or resource exhaustion.
- SC:N / SI:N / SA:N — no impacts to subsequent systems are rated. The remaining vector entries (E:X, CR:X, IR:X, AR:X, and the modified-metric set) are unspecified in the published score.
One further detail deserves attention: the vulnerable write sits in an import flow. Import paths typically perform bulk writes, and the description indicates this particular write site lacks the readRight() gate. Beyond the identifiers quoted above — spaceAffectList, the import flow, the join INSERT, readRight() — the internal code structure, request routing, and parameter names are not fully disclosed in the available data.
A note on why the import flow matters. Import and synchronization paths are a recurring location for authorization gaps because they are built for throughput: they receive a batch of changes and translate them into writes with as few per-record decisions as possible. When one of those writes establishes a cross-boundary relationship — here, a user joined to a space — the per-record decision that must survive is exactly the rights check. In CVE-2026-63174, the description indicates it did not: the join INSERT ran without readRight(), and the affectation completed against a space the caller had no rights over. This is an observation about the class, not additional disclosed detail; the advisory data does not describe the surrounding code.
Affected Software and Versions
The affected product is Omnispace Agora Project. All versions before 26.10.0 are affected. The fix is published as version 26.10.0, available through release tag 26.10 on the project’s GitHub repository at github.com/xech/agora-project; the project also maintains a website at agora-project.net.
The advisory data does not enumerate individual vulnerable releases beyond the stated before-26.10.0 boundary, and no other products or branches are named. Operators should therefore treat every deployed release prior to 26.10.0 as affected and verify the running version against the 26.10.0 release. Because the project’s code and releases are published on GitHub, the 26.10 release page is the authoritative reference for the fixed version.
Impact
The direct impact, stated in the description, is manipulation of user-space assignments across unauthorized spaces. A space administrator — a role that should govern only its own space — can insert users into any target space, because the write path never asks whether the caller holds rights there. The description frames the systemic consequence as a break in tenant isolation: the guarantee that one space’s administration cannot reach into another space fails.
The CVSS 4.0 scoring rates the impact on the vulnerable system as high for both confidentiality (VC:H) and integrity (VI:H), with no availability impact (VA:N). The integrity rating maps directly onto the described behavior: membership data — the assignments that define who belongs where — is written without authorization. The high confidentiality rating is consistent with tenant-isolation breakage, since assignments that cross unauthorized boundaries undermine the isolation that space membership is supposed to enforce. The advisory data does not, however, describe specific data exposure chains; those details are not fully disclosed.
The attacker profile is narrow but realistic: an authenticated space administrator. Exploitation requires no user interaction, no special conditions, and no privilege escalation beyond the role the attacker already holds. In practical terms, the risk concentrates where space administration is delegated broadly — every delegated administrator becomes a potential cross-space writer — and where a compromised space administrator account inherits the same capability. Per the data available for this article, the vulnerability is not listed in the KEV catalog, and the advisory data does not describe exploitation in the wild.
Exploitation Scenario
The following scenario is illustrative, reconstructed strictly from the vulnerability description. It is not a published proof of concept, and exact request details are not fully disclosed in the available sources.
Consider a deployment of Agora Project organized into multiple spaces, each with its own administrator. Alice administers Space A and holds no rights over Space B, which belongs to a different team. Under the intended access model, Alice’s affectation rights stop at Space A’s boundary.
Running a version before 26.10.0, the deployment processes an affectation through the import flow. Alice drives the spaceAffectList affectation with Space B as the target, supplying the users she wants placed there. The import flow reaches the join INSERT — the write that binds users to spaces — and executes it. Because the code never calls readRight() to verify Alice’s rights to Space B, the INSERT completes: the users are now assigned into Space B, a space entirely outside Alice’s authority.
The manipulation is repeatable across any target space, since the missing check is not tied to one space but to the write path itself. Tenant isolation is broken not by leaking data around the boundary but by rewriting the membership records that define the boundary. What the attacker does with those assignments — and what data becomes reachable as a result — is not described further in the advisory data.
Detection and Mitigation
Mitigation. The fix is to upgrade Omnispace Agora Project to version 26.10.0, published as release tag 26.10 on the project’s GitHub repository. The advisory data describes no workarounds, so upgrading is the only documented remediation. Administrators who cannot upgrade immediately should at minimum review which accounts hold space administrator roles, since that role is the sole attacker prerequisite described.
Detection. Endpoint paths, parameter names, and request formats are not fully disclosed in the available data, so detection guidance is necessarily structural rather than signature-based. Operators can look for the behavior the vulnerability produces:
- User-space assignment records whose creator holds no rights to the target space — any membership created by an administrator whose authority does not cover the target space is a candidate indicator.
- Import-flow activity that results in cross-space affectations, since the description pins the unauthorized write to the import flow’s join INSERT.
- Membership changes that no legitimate administrative action explains, reviewed against the delegation of space administrator roles.
Verification after upgrade. Once on 26.10.0, operators can confirm the fix behaves as intended by exercising the space administration functions in a test environment: an administrator of one space should no longer be able to complete an affectation targeting a space they hold no rights over. The advisory data does not include test procedures or regression cases, so this check should be designed against your own deployment.
Exploitation status. Per the data available for this article, CVE-2026-63174 is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, and the advisory data does not describe observed in-the-wild exploitation.
Bug Bounty Angle
Missing authorization on cross-tenant writes is one of the most consistently rewarded vulnerability classes in bug bounty programs, and CVE-2026-63174 is a textbook instance of the pattern: a single database write in an import flow, missing exactly one rights-verification call. For researchers, the transferable value here is the hunting method, not the specifics of this product.
A practical methodology for this class on any multi-space or multi-tenant product:
- Enumerate every administrative action that writes a relationship between a principal and a resource — memberships, assignments, shares, delegations.
- For each write, attempt the action against a target outside your authority: a space you do not administer, a tenant you do not belong to. The question is whether the server validates rights on the target, or only authenticates the caller.
- Pay particular attention to import and bulk paths. Bulk writes are where per-target checks are easiest to omit, and CVE-2026-63174 sits in exactly such a path — an import flow’s join INSERT lacking a
readRight()call. - When a write succeeds against an unauthorized target, document the state change precisely: which record was created, under which authority, and which isolation guarantee it breaks.
Two caveats keep this honest. First, the available data identifies no bug bounty program for Agora Project; the project’s code and releases are published on GitHub (xech/agora-project), and researchers can review the 26.10 release to study the affected code, but the advisory data does not include the patch diff. Treat this CVE as a pattern to hunt for in programs that cover multi-tenant collaboration platforms. Second, authorization testing means deliberately writing state on the target — only test systems you are permitted to test, and coordinate state-changing probes with the program owner.
Frequently Asked Questions
What is CVE-2026-63174 and what does it allow?
A broken access control vulnerability (CWE-862) in Omnispace Agora Project before 26.10.0. The spaceAffectList affectation runs without verifying the caller’s rights to the target space, letting a space administrator assign users into spaces outside their authority and break tenant isolation.
What is the CVSS score of CVE-2026-63174?
8.6 HIGH under CVSS 4.0 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N): network-exploitable, low attack complexity, low privileges required, no user interaction, high confidentiality and integrity impact, and no availability impact.
How is CVE-2026-63174 fixed?
Upgrade Omnispace Agora Project to version 26.10.0, published as release tag 26.10 on the xech/agora-project GitHub repository. No workarounds are described in the available advisory data.
Is CVE-2026-63174 being exploited in the wild?
Per the data available for this article, CVE-2026-63174 is not listed in CISA’s Known Exploited Vulnerabilities catalog, and the advisory data does not describe in-the-wild exploitation.
Discovery and Credits: Discovered by Geoffrey Robert of akailabs and Valentin Holubec of akailabs; CVE assigned by VulnCheck.
References
The following references are the complete set cited for this article:
Leave a Reply