CVE-2026-63174

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0

Description Broken access control allows a space administrator to assign users to spaces outside their authority. This occurs because the spaceAffectList affectation is performed without verifying the caller's rights to the target space. Specifically, a missing readRight() check in the import flow's join INSERT allows attackers to break tenant isolation and manipulate user-space assignments across unauthorized spaces.

Recommendations Update Omnispace Agora Project to version 26.10.0 or later.