PT-2026-113339

CVE-2026-63163

Published

2026-10-13

Updated

2026-10-13

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0

Description Broken access control in the 'MobileFileDownload' route allows unauthenticated attackers to download arbitrary files. The system fails to perform proper authorization checks, instead relying on an md5(filename) token. Attackers who can guess or determine file names can generate the required token to retrieve protected files, resulting in unauthorized information disclosure.

Recommendations Update to version 26.10.0 or later. Restrict access to the 'MobileFileDownload' route as a temporary mitigation measure.

Exploitability

Exploit

Fix

Impacts

Researchers

Geoffrey Robert

Valentin Holubec

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key